Automatic Sign-In from the Portal
Every OpenBoxes Lift account includes automatic sign-in, powered by Keycloak: you sign in once to the Lift portal, and clicking Launch OpenBoxes opens your OpenBoxes instance without re-entering credentials.
Automatic sign-in is not company single sign-on (SSO). Looking for company sign-in (SSO) with your own identity provider? See Company Sign-In (SSO).
How Automatic Sign-In Works#
When you sign in at app.openboxes.cloud, Keycloak (hosted at auth.openboxes.cloud) handles the authentication. Here is the flow:
- You enter your email address on the Lift sign-in page and click Continue, then enter your password on the next page
- Keycloak verifies your credentials and creates a session
- You are signed into the Lift portal
- When you click Launch OpenBoxes, the portal uses your existing session to authenticate you with OpenBoxes automatically
- OpenBoxes opens in a new tab, no second login required
This means your team only needs to remember one set of credentials for everything on the Lift platform.
Session Management#
Session Duration#
Your portal session stays active as long as you are using the platform. Sessions expire after a period of inactivity:
| Setting | Standard sign-in | With "Remember me" |
|---|---|---|
| Session timeout (idle) | 14 days | 7 days |
| Session maximum | 30 days | 30 days |
Your OpenBoxes instance keeps its own session, which times out after 2 hours without activity. When a session expires you are redirected to the login page; sign in again and continue where you left off (unsaved edits in an open form are not preserved).
Signing Out#
Clicking Sign Out in the portal ends your portal session. Your OpenBoxes session is separate: sign out inside OpenBoxes as well, or it ends by itself after 2 hours without activity.
Password Policies#
Lift enforces the following password requirements for all accounts:
- Minimum 12 characters
- At least three of these four: an uppercase letter, a lowercase letter, a number, a special character
- Cannot be the same as your username
- Cannot reuse any of your last 10 passwords
These requirements are set platform-wide and are not currently customisable per account.
Password Reset#
If you forget your password:
- Enter your email address on the sign-in page and click Continue
- Click Forgot Password? on the password page, then enter your email address
- Check your inbox for a reset link (valid for 24 hours)
- Set a new password that meets the policy requirements
Connecting an External Identity Provider#
Available now, set up with our team. Company sign-in lets your people sign in with their company account from your own identity provider (Microsoft Entra ID, Okta, Google Workspace, or any standard SAML 2.0 or OpenID Connect provider). It is included on Enterprise; on Dedicated it is a paid add-on at $299/month on the Dedicated Tier monthly plan or $2,900/year on the Dedicated Tier annual plan. It is not available on the Shared Tier.
Your organization verifies its email domain with a DNS TXT record, and we connect your identity provider with you. On Dedicated you buy the add-on in Billing under Browse add-ons; the setup is not switched on from a page in the portal, so after buying it email sales@openboxes.cloud or ask in the portal support chat. See Company Sign-In (SSO) for the details, including what it does not do.
Every Lift account also has automatic sign-in (see above), which takes you from the portal into OpenBoxes with one credential, and supports Google, Microsoft and GitHub as individual sign-in methods. Neither of these is company sign-in.
Multi-Factor Authentication#
Lift supports multi-factor authentication (MFA) through Keycloak. Users can enable MFA on their account by:
- Signing into the portal
- Going to Settings > Security
- Clicking Enable MFA
- Scanning the QR code with an authenticator app (Google Authenticator, Authy, etc.)
- Entering the six-digit code the app shows, then saving the recovery codes
MFA is optional for every customer role, including the account owner and Admins: each person enrols themselves from Settings > Security. Organisation-wide enforcement is not available.
Once you have set up MFA, signing in with Google, Microsoft or GitHub asks for your code too: the code page appears after you come back from the provider, on the portal and on your OpenBoxes instance's login page. If you have not set up MFA, those sign-ins do not ask for a code. If you are already signed in, you stay signed in; the code is asked for the next time you sign in after signing out, or when your session ends (at most 30 days).
Recovery codes#
Setting up MFA gives you 10 single-use recovery codes; save them somewhere safe. If you lose your authenticator, click Lost your authenticator? Use a recovery code on the code page at sign-in (or open app.openboxes.cloud/auth/mfa-recover) and enter your email and one code. That removes the authenticator and cancels the rest of that set, so set MFA up again afterwards in Settings > Security. With no codes left, email support@openboxes.cloud. See Account Setup for the full steps.
Troubleshooting#
"Access Denied" after signing in#
Make sure the email address on your Google, Microsoft or GitHub account matches the email on your Lift invitation. Email matching is case-insensitive.
Session expired unexpectedly#
Portal sessions are long-lived (see Session Duration above). Your OpenBoxes session is separate and ends after 2 hours without activity; click Launch OpenBoxes in the portal to be signed in again automatically. If you are being signed out of the portal more often than expected, contact support.
