--- title: "Accounts, Login, and Access Paths" category: "getting-started" canonical: "https://www.ai-go.app/en-US/docs/guide/account-setup" locale: "en-US" last_updated: "2026-08-10" source: "AI GO 開發者文件（https://www.ai-go.app）" --- # Accounts, Login, and Access Paths AI GO has no single front door. Where you come in depends on what you're doing. This chapter clarifies the access path for each kind of identity, plus how accounts are created and recovered. --- ## Identify which kind of user you are | Identity | Access path | Account source | |---|---|---| | Administrator / developer | Dashboard | Organization member account | | Internal app user | The app's dedicated URL | **The same** organization member account | | External app user (customer, supplier) | The app's dedicated URL | That application's own user system, separate from member accounts | | Third-party system / script | REST API | API key — **no human login required** | That last row is easy to miss: if your goal is to connect AI GO to an existing system, what you need is an API key, not a login. See Chapter 11. --- ## Organization member accounts ### How they're created Administrators invite members from **Member Management** in the Dashboard. The invitee receives an activation email and sets a password through the link. Activation links expire. If yours has expired, ask your administrator to resend it — clicking an expired invitation is the single most common entry problem, and the system says so explicitly rather than failing silently. ### Password requirements - At least 8 characters - Must include uppercase, lowercase, a digit, and a special character ### Google Single Sign-On If your organization has configured SSO under **Organization & Access Control › Single Sign-On**, members can sign in with Google instead. This uses a **bring-your-own OAuth client** model — your own Google Cloud project credentials, with account binding keyed on Google's stable user identifier. Configuring it requires the `system.tenant_settings` permission. ### Deactivation and offboarding Administrators can deactivate a member directly from Member Management without deleting the account. A deactivated member cannot log in anywhere — including Custom Apps — while their history and related records remain intact. --- ## Workspace names Each organization has a workspace name used to construct its dedicated URLs. Once chosen it is retained long-term, and it is protected in three ways: - **Globally unique** across organizations - **Reserved words blocked** — `admin`, `api`, `www`, `login`, and similar cannot be used - **Impersonation detection** — visually confusable substitutions across writing systems (for example Cyrillic characters mimicking Latin ones) are detected and rejected, blocking names crafted to impersonate another organization or the platform itself If you've forgotten your organization's workspace name, the login page offers a "forgot workspace" flow that emails you a reminder. --- ## Custom App users ### Internal apps Internal app users **are organization members** — no separate registration. Open the URL your administrator gave you and sign in with your organization account. If you're already signed in to another AI GO app in the same organization, you'll usually be carried straight through. What you can see and do inside an internal app is determined by your roles. Applications can read the current user's roles and permission tags and show or hide functionality accordingly. ### External apps External apps have **their own user system**, entirely separate from organization member accounts. External users (customers, suppliers, partners) register themselves or are created by an administrator. Administrative capabilities: - Manage the app's users from the **Users** tab in the Builder - Change a user's email address - Reset a user's password on their behalf Self-service: - Users can change their own password without administrator involvement --- ## Troubleshooting ### Forgotten password Click "forgot password" on the login page and enter your registered email. The reset link lands on **your organization's dedicated URL** — click it directly rather than editing the address. ### Locked account Five consecutive failed password attempts trigger a 15-minute lockout as brute-force protection. It clears automatically; an administrator can also help. ### "An invitation link is required" Opening the registration page on an organization URL without a valid invitation will not render the "register a new team" form — that would create a second organization by mistake. Ask your administrator for an invitation link. ### Repeatedly redirected to onboarding This means initial account setup was never completed. Walking through the setup form once resolves it. If it recurs, contact platform support. --- ## For third-party systems: API keys If you're connecting a system rather than a person, the path is entirely different: 1. An administrator creates an **Integration** in the Dashboard 2. They generate an API key for it (prefixed `sk_live_`, **shown exactly once**) 3. The third-party system sends it as an `X-API-Key` header on every request The API key carries its own application and organization identity — nothing else needs to be passed. One integration can hold several keys (production and staging, say), each revocable independently. Full walkthrough in Chapter 11.