Sign in to MeroFoundry
Use one of four trusted identity providers to sign in to MeroFoundry:
- GitHub
- Microsoft
- Apple
Only providers configured by the platform operator appear on the sign-in page. If a provider is not shown, it is not currently available.
How sign-in and linking work
Section titled “How sign-in and linking work”We recognise an identity by its provider and its unique account identifier. If you have used that identity before, it signs you in. If it is new but the provider has verified that its email address matches an existing MeroFoundry account, we link it to that account. If the provider has not verified the email address, we refuse the link. Otherwise, we create a new MeroFoundry tenant for you.
You may see one of these messages:
link_conflict: that provider identity is already linked to another account. Sign in with the provider you used before.email_unverified: your provider has not verified this email address, so we cannot safely link it to an existing account. Verify the address with the provider, or use the provider already linked to your account.
Linked identities
Section titled “Linked identities”In account settings, the Linked identities panel lets you add another provider to your signed-in account or remove a provider you no longer use. You cannot remove your last sign-in method.
Work accounts and tenant owners
Section titled “Work accounts and tenant owners”When you use a work Google or Microsoft account, your employer may control that identity. We show a one-time reminder to add another tenant owner or a personal linked identity, so you are not locked out if you change jobs or lose access to the work account.
A tenant can have more than one owner, and ownership can be transferred. Billing, plans, and invoices belong to the tenant rather than to one person.
Operator configuration
Section titled “Operator configuration”Configure a provider with flat environment variables, or with same-named lower-case files in
SECRETS_DIR. Leaving any required value absent keeps that provider hidden.
| Provider | Variables |
|---|---|
| GitHub | GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GITHUB_OAUTH_REDIRECT_URI |
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_OAUTH_REDIRECT_URI |
|
| Microsoft | MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_OAUTH_REDIRECT_URI |
| Apple | APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_PRIVATE_KEY, APPLE_OAUTH_REDIRECT_URI |
Apple requires an Apple Developer team, a key ID, and the .p8 private key as well as its client
ID. Its client secret is signed from that material and must be rotated at least every six months;
operators should maintain an alert for that rotation deadline.
APPLE_PRIVATE_KEY is the one multi-line secret here, and the production environment cannot
carry one: the backend reads env_file: [/opt/merofoundry/app.env], which docker parses a line
at a time, and ops/pull-env.sh refuses to render a secret whose value contains a newline (it
fails the whole pull rather than writing a broken file). Store the .p8 on a single line with
\n escapes instead; settings restores the real newlines before PyJWT signs with it, and a key
that already has real newlines (a local .env, a SECRETS_DIR file) is accepted unchanged.