No passwords, ever
Fargone has no password login. You authenticate with passkeys (WebAuthn) or single sign-on from an identity provider. This removes password phishing and leaky credential reuse from the equation entirely.
Passkeys
A passkey is a private key that never leaves your device, backed by the platform authenticator — Face ID, Touch ID, Windows Hello, a security key, or your phone.
- Sign up: enter your handle (e.g.
@lalala), email, and solve the captcha, then approve the passkey prompt. - Sign in: tap Sign in with a passkey and approve the prompt.
Passkeys work over HTTPS, and on localhost during development.
Handles
Handles (@lalala, letters/numbers/underscores) are unique and can be
changed from Settings → Account. When you sign up with SSO and your
provider name is already taken, Fargone appends random characters to keep the
handle unique.
SSO
Sign in with GitHub, Google or Discord. The login page shows whichever providers are enabled on this instance. You can also link additional SSO providers or add more passkeys later from Settings → Account.
Sessions
Sessions are opaque, http-only, rotating cookies backed by the database. Sign out from Settings → Account.
Deleting your account
Settings → Account → Danger zone deletes your account for good: passkeys, SSO links, projects, databases, CDN files and OAuth clients are removed and running containers are stopped. This can't be undone. The instance's last admin can't delete their own account.
Approval gate
New accounts start as PENDING. An admin must approve the account before the
user can create apps or databases. Members with the ADMIN role manage approvals
in Admin → Approvals.
Being an OAuth provider
Fargone is itself an OAuth 2.0 + device-flow provider, so third-party apps can authenticate users with their Fargone account. See OAuth.