Identity
Sign-in
Email and password or OIDC in the dashboard; a device flow in the CLI.
The dashboard signs members in with email and password through Supabase Auth, protected by a Cloudflare Turnstile check, or through an OIDC provider. Onboarding creates the organization for a new signup.
`wl login` runs an OAuth device authorization flow against your registry’s issuer, or a PKCE browser flow when the issuer is Supabase. Role mappings map identity-provider role names to Workloom roles.