CLItrail Docs

Sign in

CLItrail signs you in with your Google account or with a one-time link sent to your email address, through Firebase Authentication. There is no CLItrail password; CLItrail keeps a session of its own.

#Two ways to sign in

  • Continue with Google. Google’s sign-in opens in a popup; if the browser blocks popups, the page goes to Google and back instead. Google keeps your password and two-step verification.
  • Email me a sign-in link. Enter your email address and Firebase emails you a link. Open it on the same device and browser and you are signed in straight away: the dashboard remembers the address in that browser’s local storage for up to a day. Opened on another device or browser, the page asks you to confirm the address first, because Firebase only accepts the address the link was sent to. Each link works once, and the dashboard lets you send a new one after 60 seconds.

Your first sign-in, either way, creates your own organisation on the Free plan. An invitation link is kept through the email link, so you join the organisation as soon as you are signed in on the device that asked for the link.

#What the server checks

  1. The page sends CLItrail the Firebase ID token the sign-in returned. CLItrail never sees a Google password.
  2. The server verifies the token itself: its RS256 signature against Google’s published keys, its audience (CLItrail’s Firebase project), its issuer, and that it is current and from a sign-in in the last five minutes. It also asks Firebase whether the account was disabled or its tokens revoked.
  3. Only a Google sign-in or an email link is accepted. Firebase issues an email-link sign-in under its Email/Password provider, so that provider is accepted only when the email address is verified, which opening the link does. A password account created any other way and never verified is refused with email_not_verified.
  4. CLItrail then starts its own session: an HttpOnly, SameSite=Strict cookie, Secure on https, valid for 7 days. Your account is keyed by your Firebase user ID, and your email comes from the verified token, never from the page.

#Your email address

Invitations are matched to the verified email address you sign in with, by either method. An email link always verifies the address it was sent to. A Google Workspace or Gmail address is verified; if your Google account’s address is not, accepting an invitation answers email_not_verified.

#Sessions and confirmations

  • Account and security shows how you sign in (your Google account, or email sign-in with your address) and every CLItrail session, with when it started and was last active (updated at most every 5 minutes). Sign out one session, or every other one.
  • Deleting your account, a website or an organisation with websites asks you to confirm with a new sign-in, by the method you last signed in with. With Google, that is a popup. With email, CLItrail sends a new link to your address: open it in the same browser and the waiting dashboard tab continues on its own; on another device, copy the link from the email and paste it into the dialog.
  • An account that is disabled, or whose sessions are revoked, cannot start a new CLItrail session.

#No passwords

Google and email links are the only sign-in methods on the hosted service: there is no CLItrail password to forget or leak. To secure your CLItrail access, secure your Google account and the mailbox you sign in with, for example with 2-step verification or passkeys.

  • Check your spam folder, then send a new link from the dashboard after the 60-second wait.
  • “This sign-in link has expired or was already used”: links work once and expire. Enter your address to get a new one.
  • “That isn’t the email address this link was sent to”: enter the address you asked for the link with.
  • “Today’s limit is reached”: the service has sent as many sign-in emails as Firebase allows today. Continue with Google, or try again later.

#Service configuration

For the people running a CLItrail service, in its Firebase project:

  1. Authentication → Sign-in method: enable Google, and Email/Password with its Email link (passwordless sign-in) option. Enable no other provider. Without the email-link option, the dashboard reports that email sign-in links aren’t turned on (auth/operation-not-allowed).
  2. Project settings: set the public-facing name to CLItrail; the sign-in email names the app with it.
  3. Authentication → Settings → Authorized domains: keep clitrail.com, the staging host and localhost. Links that return to any other host are refused.
  4. Upgrade the project to the Blaze plan before launch: on the Spark plan Firebase sends only 5 email-link sign-ins a day, on Blaze 25,000 (Firebase Authentication limits).