Signing in

The welcome screen is the signed-out home: the DomainGuard mark, one line of tagline, and Sign in with Apple as the first button. Under it: Continue with email, Scan QR code to sign in, and Check a domain without an account.

Apple asks for your name and email only the first time. If you hide your email, DomainGuard receives Apple's relay address and uses it as your account email. Revoking DomainGuard in your Apple ID settings has no effect on your DomainGuard session. An account created with email can link Apple later from Profile (/api/auth/apple/link), and the web supports the same sign-in. See Sign in with Apple.

Email

A full screen you push into: labelled fields, a show/hide password button, "Forgot password?", and, when a session is already saved on this phone, Use Face ID. A wrong password does not show a red box: the field shakes once (not with Reduce Motion on), a message fades in, "Reset password by email" appears, and Sign in with Apple is offered as the alternative. If the server has locked the account after too many failed attempts, its own message appears (the lock lasts 30 minutes).

Creating an account happens on the same screen: "New here? Create a free account · no card needed." The text-message consent wording is shown there.

QR code from the web

On the web dashboard, Account settings generates a one-time QR code. In the app, Scan QR code to sign in opens the camera (the only camera use in the app), reads the code, and redeems it for a session on the phone. The code is single use and short lived. See QR sign-in and mobile handoff.

Face ID

Face ID or Touch ID unlocks a session that is already saved in the Keychain on this phone. It is a convenience for re-entering the app after a sign-out, not an app lock: a saved session opens straight into the app, by design.

Two-factor code

If two-factor authentication is on for the account, a code sheet follows the password. A recovery code works in the same field. Two-factor is set up on the web; see Two-factor authentication.

Staying signed in

The app never signs you out on a network error, a 401 during a refresh, or a Keychain read failure. Tokens refresh silently for 90 days of use; a failed refresh shows a banner. Sign out is a row in the Account list and keeps the account and its data.

Common questions

The app asks me to allow notifications right after sign-in. That is the alerts prompt ("Know before a customer tells you."). Not now is fine; Account, Notifications asks again.

I signed in with Apple on the web and with email in the app. Two accounts? Only if the emails differ. Link Apple to the email account from Profile and both sign-ins land on the same account.