Sign-in methods

sherlock supports several ways to prove it's you, and an account can have more than one active at once.

Password

The usual email-and-password pair. Set or change it from the account page's sign-in methods tab; a password is optional — plenty of accounts never set one and sign in with a one-time code or a social provider instead.

One-time email code

A six-digit code sent to your email, entered directly in the sign-in form — not a magic link you click. It expires quickly and is single-use, so a code emailed to you can't be replayed later.

Google and GitHub

Sign in through either provider's own OAuth flow instead of an email and password. sherlock links the resulting identity to your account by email; the first sign-in with a given provider creates the account if one doesn't already exist for that email.

Two-factor authentication

An optional second step on top of a password: enable it from the account page, scan the QR code with an authenticator app, and confirm with the six-digit code it produces. Once enabled, signing in with a password also requires that code. Two-factor can only be enabled once a password is set — there's no second factor to add to a passwordless account.

Disabling two-factor asks for confirmation before it takes effect, since it's a real reduction in how hard the account is to break into.

Next

Sign in with sherlock (redirect) — using sherlock as the identity provider for a different app entirely.