Bot challenge (Turnstile)
Sign-in, sign-up, and forgot-password screens include a Cloudflare Turnstile widget. You must complete the challenge before Sign in, Create account, or Send link becomes available. If verification fails, the form shows a retry message and resets the widget.
Local development and automated tests use Cloudflare’s documented always-pass test keys. Production builds use real Turnstile keys configured at deploy time.
Sign up
Register at /signup with First name, Last name, email, and password (at least 12 characters). New accounts are verified immediately and you are signed in after a successful create.
If a previous signup attempt left your account without a password (for example, a network interruption), submitting the form again with the same email repairs the account and signs you in.
If the email already has credentials, Probara responds with a neutral Check your inbox screen that does not reveal whether the address was new. Use Sign in or Forgot your password from that screen.
If sending email fails on that collision path (rare), the screen shows a Retry button instead of a generic error.
Log in and log out
- Log in:
/login - Log out: user menu in the app header → Log out
Sessions use a secure HttpOnly cookie. Closing the browser does not always end the session until logout or expiry.
Sign in with Google
/login and /signup also offer Continue with Google. Selecting it sends your browser to Google, and Google returns you to Probara once you approve access.
Depending on the state of your account, one of four things happens:
- You already linked Google to a Probara account: you are signed in immediately.
- No Probara account uses that email yet: a new account is created and verified automatically, and you are signed in.
- The email already has a Probara password, but is not linked to Google yet: Probara does not sign you in automatically. You are asked to confirm your existing password once; after that, your Google account is linked and you are signed in.
- The email exists but has no password and no Google link yet (a rare collision): sign-in is refused with the same message as an unrecognized account, and you are guided to sign in or reset your password instead.
If you cancel at Google, your Google account’s email is not verified, or the request otherwise fails, you land back on /login with a message describing what happened.
Probara never sees or stores your Google password, and it does not keep the ID token or access token Google issues during sign-in — only your email, name, and Google account identifier are recorded, so Probara can recognize you on your next sign-in.
Connections
/user/connections, a sibling of /user/profile, shows which credentials can open your account. It lists whether your Google account is linked: the address that was linked, when, and when it was last used to sign in (or that it has never been used to sign in since linking). An account with no Google link shows that plainly instead of leaving the question unanswered.
Disconnecting Google
If your account has a Google link, the screen offers a Disconnect control. Activating it opens a confirmation naming the Google account being removed; nothing happens until you confirm.
Probara refuses to disconnect Google when doing so would leave your account with no way to sign in — for example, a Google-only account with no password set. The screen explains this specifically rather than showing a generic error, and the connection stays listed because nothing was removed. Set a password from /user/profile first, then disconnect.
Disconnecting Google does not sign you out anywhere: every active session, on every device, keeps working exactly as before. It only removes that one way of signing back in later.
Connecting Google proactively
If your account does not have a Google link yet, the not-connected state on /user/connections offers a Connect control. Activating it starts the same Google sign-in you know from /login and /signup, but this round trip only ever adds a credential to your already-signed-in account — it never creates a second account and never replaces your current session.
If the round trip fails for any reason — you cancel at Google, the email Google reports is not verified, your session changed while you were away, or the Google account you picked is already linked to a different Probara account — you land back on /user/connections, never on /login: you never left your session, so a login page would be the wrong message. If you already hold a different Google account and try to connect another one, disconnect the first one and try again.
Forgot password
Use the reset flow from /login (forgot password link). You receive an email with a time-limited link to set a new password. The email is sent in the same language as the app UI you used when requesting the reset (English or Spanish).
Security notes
- Use a unique password for your Probara account.
- Invitation signup locks the email field to the invited address.