# Sign-in and workspace access

Open the Fleetlane workspace address supplied by your administrator. You need an
invitation and an active account for that workspace; authentication alone does
not give access to product records or actions. There is no public signup.

## Sign-in screens

Fleetlane signs you in on its own screens at your workspace address, carrying
your organisation's branding. WorkOS handles the identity behind them: it checks
passwords and codes and sends the authentication emails. You never leave the
workspace address to sign in.

On the sign-in page, use the methods it offers:

| Method                       | What you do                                                                    |
| ---------------------------- | ------------------------------------------------------------------------------ |
| Password                     | Enter your account email and password                                          |
| Email code                   | Request a code and enter it on the same screen                                 |
| Enterprise Microsoft sign-in | Follow your organisation's Entra sign-in, when it is set up for this workspace |

An organisation can require enterprise sign-in. Then the screen sends you
straight to it and email sign-in is not offered. A WorkOS organisation or an
invitation alone does not turn on enterprise sign-in: an operator configures
the connection and policy for the workspace. Social sign-in is not offered.

## Accept an invitation

1. Open the invitation email and check that it names the workspace you expect.
2. The acceptance screen shows the invited email, which you cannot change.
   Request an email code and enter it in the same browser.
3. If you are new, set a password of at least 12 characters with a lowercase
   letter, an uppercase letter, a number and a symbol. If you already have one
   from another workspace, choose **I already have a password** and confirm it.
4. Complete any verification or additional security step the screen asks for.

If the email is wrong, ask the administrator for a corrected invitation. An
expired or revoked invitation cannot be accepted. Accepting an invitation does
not replace an existing account's password or grant access to other workspaces.

## Verification and additional security

Email verification and email sign-in use a code from WorkOS; enter it on the
active screen or use its resend action. Password confirmation asks for your
existing password before a protected step and grants nothing new.

When your organisation's policy requires multi-factor authentication, the
screen asks you to enrol an authenticator app and then enter its code at each
sign-in. An expired or failed code means starting again from the same workspace
address rather than reusing an old code.

## Recover a password

Choose **Forgot password**, enter your account email and follow the reset
message. The screen does not say whether an account exists for that email. The
reset link opens a screen where you set a new password under the same rules;
then sign in again. A reset does not sign you in or give workspace access.
Where email codes are offered, they let you sign in without a password.

## Authentication emails

WorkOS sends invitations, verification and sign-in codes and password resets.
Fleetlane's notification and integration mail settings do not control these
messages. Do not use a customer or campaign email setting to recover staff
access.

## Shared identity and separate workspace access

Within one provider environment, the same account can be invited to several
Fleetlane workspaces and to the lifecycle engine, with one password. Staging and
production have separate identity pools.

Each workspace has its own WorkOS organisation. Membership is checked alongside
the local invited account, its active state and its roles. Signing in to one
workspace grants nothing in another, and browser sessions are bound to their
application and host. Recovering your password changes it for every workspace
that account belongs to.

## Administrator checks

Confirm the intended workspace, email, active local account, organisation
membership and role assignments. A person may authenticate and still lack
permission to enter the workspace or perform a particular action. Dealer role
assignments also restrict dealership scope. See
[Isolation & access](https://docs.fleetlane.app/security/isolation-access/) and
[Access & field control](https://docs.fleetlane.app/functionalities/access-field-control/).

## When sign-in or access fails

Check the exact workspace address, invited email and account state. For a
missing invitation or recovery message, check spam and organisation mail
filtering, then ask the administrator to review the invitation. A successful
sign-in followed by refused access needs membership and role checks; repeating
password resets will not assign that access.

For support, provide the workspace address, time, sign-in step and visible
message. Keep passwords, codes, invitation and reset links, session cookies and
authenticator secrets private.