Authentication

Bot challenge (Turnstile)

Sign-in, sign-up, and forgot-password screens include a Cloudflare Turnstile widget. You must complete the challenge before Sign in, Create account, or Send link becomes available. If verification fails, the form shows a retry message and resets the widget.

Local development and automated tests use Cloudflare’s documented always-pass test keys. Production builds use real Turnstile keys configured at deploy time.

Register at /signup with First name, Last name, email, and a password that meets the password requirements. You are signed in right away, and Probara emails you a link to verify your address.

Password requirements

A new password, whether you sign up, reset it, or change it, needs at least 12 characters and must meet at least 3 of these 4 requirements:

At least 12 characters
Upper and lowercase letters
A number
A symbol

So beyond the length, it needs two of the other three. The meter under the field shows which requirements the password meets as you type. Suggest one fills in a 20-character password that meets all four and shows it, so you can save it in your password manager. Probara also refuses passwords that appear in known data breaches.

If the email already has an account, Probara does not create a second one: it shows a Check your inbox screen and emails that address instead. Use Sign in or Forgot your password from that screen. This includes accounts your organization created for you through SCIM: set your password with Forgot your password.

Verify your email

Open the link in the verification email and select Verify email to confirm that the address is yours. The link works for 24 hours. Until you verify, a banner at the top of the app (and of the onboarding screens) reminds you; select Resend link there to get a new link (each new link replaces the previous one).

You can sign in and work in your own organization before verifying. These actions need a verified address; until you verify, Probara asks you to verify your email first:

Accepting an invitation by email
Inviting members or resending an invitation
Creating API tokens or approving an MCP client
Connecting Google from Connections
Turning on two-factor authentication

You do not need a separate verification when you sign up from an invitation link, sign in with Google or your organization’s SSO, confirm an email change, or reset your password: each of these already proves the address.

If you did not create the account, ignore the email.

Log in and log out

Log in: /login
Log out: user menu in the app header → Log out

Sessions use a secure HttpOnly cookie. Closing the browser does not always end the session until logout or expiry.

If there are too many sign-in attempts for one address, Probara pauses password sign-in for that address: after 10 attempts within an hour, further attempts are refused for up to an hour. A browser where you have signed in before keeps its own allowance, so you can still sign in from it.

/login also offers Google, and /signup offers Continue with Google. Selecting either sends your browser to Google, and Google returns you to Probara once you approve access.

Depending on the state of your account, one of four things happens:

You already linked Google to a Probara account: you are signed in immediately.
No Probara account uses that email yet: a new account is created and verified automatically, and you are signed in.
The email already has a Probara password, but is not linked to Google yet: Probara does not sign you in automatically. You are asked to confirm your existing password once; after that, your Google account is linked and you are signed in.
The email exists but has no password and no Google link yet (a rare collision): sign-in is refused with the same message as an unrecognized account, and you are guided to sign in or reset your password instead.

If you cancel at Google, your Google account’s email is not verified, or the request otherwise fails, you land back on /login with a message describing what happened.

Probara never sees or stores your Google password, and it does not keep the ID token or access token Google issues during sign-in — only your email, name, and Google account identifier are recorded, so Probara can recognize you on your next sign-in.

Connections

/user/connections, a sibling of /user/profile, shows which credentials can open your account. It lists whether your Google account is linked: the address that was linked, when, and when it was last used to sign in (or that it has never been used to sign in since linking). An account with no Google link shows that plainly instead of leaving the question unanswered.

Disconnecting Google

If your account has a Google link, the screen offers a Disconnect control. Activating it opens a confirmation naming the Google account being removed; nothing happens until you confirm.

Probara refuses to disconnect Google when doing so would leave your account with no way to sign in — for example, a Google-only account with no password set. The screen explains this specifically rather than showing a generic error, and the connection stays listed because nothing was removed. Set a password from /user/password first, then disconnect.

Disconnecting Google does not sign you out anywhere: every active session, on every device, keeps working exactly as before. It only removes that one way of signing back in later.

Connecting Google proactively

If your account does not have a Google link yet, the not-connected state on /user/connections offers a Connect control. Activating it first asks for your current password, the same confirmation changing your password asks for. An account without a password asks for a recent sign-in instead: if you signed in more than 10 minutes ago, Probara asks you to sign in again. Then the same Google sign-in you know from /login and /signup starts, but this round trip only ever adds a credential to your already-signed-in account — it never creates a second account and never replaces your current session.

When the Google account is connected, Probara emails your account address the Google address that was connected. If you did not connect it, disconnect it on /user/connections and change your password.

If the round trip fails for any reason — you cancel at Google, the email Google reports is not verified, your session changed while you were away, or the Google account you picked is already linked to a different Probara account — you land back on /user/connections, never on /login: you never left your session, so a login page would be the wrong message. If you already hold a different Google account and try to connect another one, disconnect the first one and try again.

Change or set your password

Open Password in the account side rail (/user/password).

Change password: enter your current password, then the new one twice. The new password must meet the password requirements.
Set a password: if you sign in only with Google, the same screen lets you add a password as a second way in. There is no current password to confirm, so you must have signed in within the last 10 minutes. If you signed in earlier, the screen asks you to sign in again and brings you back.

Changing or setting your password signs you out on every other device and browser. The session you used to make the change stays signed in. Probara also emails your account address to confirm the change; if you did not make it, use the link in that email to reset your password.

To change the address you sign in with, see Change your email.

Two-factor authentication

Two-factor authentication (2FA) adds a second step to signing in with your password: after the password, Probara asks for a six-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password, or Authy.

Open Security in the account side rail (/user/security).

Turn on 2FA

Select Set up authenticator app and enter your current password.
Scan the QR code with your authenticator app, or type the key shown below it.
Enter the six-digit code the app shows. 2FA is active only after Probara accepts this code. Finish within 10 minutes, or start again.
Save your ten recovery codes. Probara shows them only this once.

Turning on 2FA signs you out on every other device and browser, and Probara emails your account address to confirm it.

2FA protects password sign-in, so your account needs a password. If you sign in only with Google, set a password on /user/password first.

After your password, enter the current code from your authenticator app. If you do not have the app with you, choose Use a recovery code instead. Each recovery code works once, and Probara emails you whenever one is used.

After five wrong codes you need to enter your password again. Too many wrong codes in a short time block further attempts for a while.

Recovery codes

Keep your recovery codes somewhere safe and separate from your phone, for example in a password manager. The Security screen shows how many unused codes you have left.

Regenerate recovery codes gives you ten new codes and stops every previous code from working. Confirm with your password or a code.

Resetting your password does not turn off 2FA. If you lose both your authenticator app and your recovery codes, you cannot sign in with your password.

Turn off 2FA

Turn off two-factor authentication asks for your password, an authenticator code, or a recovery code. It deletes your recovery codes, signs you out on every other device and browser, and Probara emails you to confirm.

2FA applies to password sign-in. Signing in with Google relies on your Google account’s own protection, so turn on 2-Step Verification in your Google account too. The first time you sign in with Google using the email of an account that has 2FA, Probara asks for your password and a code before it connects the two.

Organizations that require 2FA

An organization owner can require 2FA for every member. If your account does not have 2FA yet, opening that organization shows Your organization requires two-factor authentication instead of its pages. Select Set up two-factor authentication, turn on 2FA as described above, and the organization opens again. You can still switch to another organization or sign out from your profile menu.

If you turn off 2FA later, the organization closes again until you turn it back on. API keys and MCP clients keep working while the requirement is on, but a new API key or MCP approval cannot be created until your account has two-factor authentication turned on.

Forgot password

Use the reset flow from /login (forgot password link). You receive an email with a time-limited link to set a new password. The email is sent in the same language as the app UI you used when requesting the reset (English or Spanish). Setting a new password also verifies your email address and signs you out everywhere else. Each reset link works once. It also stops working when you request a newer one, change your password, or confirm a change of email address.

Security notes

Use a unique password for your Probara account.
Turn on two-factor authentication on /user/security.
Invitation signup locks the email field to the invited address.