Authentication & recovery
Starfire AI authentication is designed to separate account identity from temporary browser sessions so access can be managed and revoked safely.Email and password
Email/password sign-in uses a protected password-verification flow and server-managed sessions. A successful login creates a session for the account rather than exposing reusable credentials to the client.Email verification
Some account capabilities can require a verified email address. Verification protects account recovery and reduces the risk of creating important resources under an address the user does not control. If a verification link has expired or fails, request a new verification action from the Starfire interface rather than repeatedly reusing an old link.Password recovery
Password reset links should be treated as security-sensitive, single-purpose credentials. If you did not request a reset, do not use the link. After a password or account-security change, Starfire may invalidate sessions according to the active security policy.Remember me
When enabled, Remember me affects session persistence. It does not weaken the user’s password or turn the browser into a source of truth for the account.OAuth sign-in
Supported deployments can offer OAuth sign-in such as Google or GitHub. OAuth establishes identity through the configured provider while Starfire still maintains its own account, session, permissions, billing, and organization state.OAuth availability depends on deployment configuration. The presence of an OAuth provider in the product architecture does not guarantee that it is enabled on every deployment.