Signing in to the platform with email and password.
v2: with MFA enabled, a code-entry step is added after the password — not to be confused with setting up MFA.
2
SSO v2 — the button is always visible, inactive until a provider is configured. Mechanics — SSO / OIDC.
3
A single error block — one message for every sign-in failure, so account existence is not disclosed. Brute-force protection —
defense line.
4
Session expired — a neutral notice on forced logout, shown until sign-in.
5
Too many attempts — the sign-in button is blocked until the rate-limit window ends. Separate from an input error. Brute-force protection —
defense line.