> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin sign-in

> How administrators authenticate to the Cobalt console.

# Admin sign-in

Administrators sign in to the console one of three ways. The first admin who
creates the workspace bootstraps it; everyone else is invited (see
[Roles & team](/identity/roles-and-team)).

| Method               | When it's used                               | Notes                                                                                             |
| -------------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Email + password** | Default for everyone until you configure SSO | Passwords are handled by Cobalt's identity service — Cobalt never stores or sees a raw password.  |
| **Social login**     | Google or Microsoft                          | Convenient for small teams; no setup required.                                                    |
| **Enterprise SSO**   | Your SAML identity provider                  | Connect once; your team signs in with corporate credentials. See [Enterprise SSO](/identity/sso). |

You do **not** have to set up SSO to get started — it's a connect-later upgrade.
Email/password works on day one, and you can require SSO later.

## Sessions

Sessions are short-lived and refresh automatically in the background, so you stay
signed in without long-lived credentials sitting in the browser. Signing out ends
the session immediately. There's nothing to configure.

## Account recovery

* **Forgot password** — use the reset link on the sign-in page. It emails a
  one-time link to your address.
* **Locked out** — after repeated failed attempts an account is temporarily
  locked; wait and retry, or have another admin help.
* **Lost access entirely** — another **Owner** or **Admin** on the workspace can
  re-invite you. A workspace always keeps at least one Admin/Owner (Cobalt blocks
  removing the last one), so you can't lock the whole team out.

## After SSO is configured

Once [Enterprise SSO](/identity/sso) is active you can choose whether
email/password sign-in stays available alongside it, or is turned off so all
admin access flows through your IdP. Social login and email/password are
independent toggles from SSO.

<Note>
  End users do **not** sign in here. They're identified by their channel — see
  [End-user identity](/identity/end-user-identity).
</Note>