> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quotamint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard authentication

> Sign in to the QuotaMint dashboard

The dashboard is for your team. It does not share sessions with your product, and the runtime API never reads dashboard cookies.

## Sign-in methods

| Method             | Where                  |
| ------------------ | ---------------------- |
| Email and password | `/signup` and `/login` |
| Google             | Sign in with Google    |
| GitHub             | Sign in with GitHub    |

The sign-in page lists every method your deployment has enabled.

## OAuth account linking

A Google sign-in whose verified email already belongs to an account created with a password links the Google identity to that existing user and signs them in. The person keeps one account and can enter through either method. Google always verifies the account email it issues, which is what makes the automatic link safe.

GitHub keeps the explicit flow: a GitHub profile can carry an unverified email, so automatic linking there could let an unverified email claim an existing user. If the email already belongs to an account, sign in using the original method. The dashboard reports an account-linking error instead of merging identities without a verified match.

Email verification is not enforced in the current product. Do not treat an unverified email as proof of identity for a sensitive workflow without adding verification in your deployment.

## Authentication versus authorization

A valid session only proves who signed in. Every dashboard request separately resolves workspace membership, role, active project, and environment. See [workspaces, projects, and roles](/dashboard/workspaces) for the permission matrix.