Sign-In & Email Identifiers
Login code, Magic Links, Microsoft, OIDC, API login links, Approved for Sign Up, and @noemail.
What This Is For
A decision table for how people sign in and what email-shaped identifier Skillhabit needs. Setup steps live under identity and Configure guides linked below.
Who This Is For
Administrators and IT choosing login methods; integrators using API login links.
Sign-In vs Provisioning
| Goal | Go here |
|---|---|
| Create or sync users (and groups) on an ongoing basis | User Provisioning |
| Choose how people prove who they are at login | SSO and Authentication |
You often need both.
Sign-In Methods
| Method | Needs existing user? | Can first login create an account? | Needs real mailbox? |
|---|---|---|---|
| Login code (Email) | No, if domain is approved | Yes, when email domain is under Approved for Sign Up | Yes |
| Magic Links (Email) | No, if domain is approved | Yes, when email domain is under Approved for Sign Up | Yes |
| Microsoft | No, if domain is approved | Yes, when Skillhabit’s picked email is on Approved for Sign Up | Prefer yes (notifications) |
| OpenID Connect | No, if auto-create is on | Yes, when More options auto-create is enabled | Prefer a real email claim |
| External API login link | Yes (create via API or other provision first) | Link only signs in; create user with Users API beforehand if needed | No—@noemail.skillhabit.com is fine |
| SAML | Workspace-specific | Contact Skillhabit if offered | Depends on IdP claims |
SSO capability is required for Microsoft / OpenID Connect. Product toggles: Configure → Connections → Authentication Methods. Email offers Login code or Magic link.
Login code (OTP) at a glance: 6-digit code, no link in the email; finish on the same browser that started login; expires in 10 minutes; locks after 5 wrong attempts; hashed at rest; resend invalidates earlier unused codes. Full detail: SSO and Authentication → Login code.
When First Login Creates an Account
| Method | Rule |
|---|---|
| Login code / Magic Links / Microsoft | Domain listed under Approved for Sign Up |
| OpenID Connect | Auto-create enabled in OIDC More options |
| API login link | Does not create—use POST /users (or Entra / SCIM / admin invite) first |
Admin invites, Entra, SCIM, registration pages, and API user create also provision outside interactive sign-in.
Email-Shaped Identifiers
| Pattern | Use when | Mail sent? |
|---|---|---|
| Real mailbox | People should get invites, reminders, Login codes / Magic Links | Yes (if email status is active) |
@noemail.skillhabit.com (unique local part) | API / SSO-only accounts with no mailbox | Never |
| Inactive email status | Delivery failed earlier | Held until Reactivate email |
How Skillhabit picks an address from Microsoft / OIDC / Entra: SSO and Email Addresses.
Delivery rules: Bulk Actions and Email.
OpenID Connect Claims (Minimum)
At least one of email, preferred_username, or upn—or sign-in cannot complete. Prefer a real email when people should receive Skillhabit notifications.
Shared Devices and Sessions
Append ?logout=true (or logout=1 / action=logout) to clear the session before the next person. Opening a magic login link ends the previous session. Manage devices under Profile → Active sessions. Details: SSO and Authentication.
