Sign-in and Authentication

UnieAI Studio currently supports Google OAuth, Microsoft Entra ID (Azure AD) OAuth, and administrator-created test accounts. The sign-in page shows only the methods configured or available in the current deployment.

Supported Sign-in Methods

Sign in with Google or Microsoft

The same email address maps to the same platform user. UnieAI Studio does not store the password for a Google or Microsoft account.

Sign in with a Test Account

Super Admins and Admins create and manage test accounts under Admin Panel → Platform users → Test accounts. They are intended for development, demonstrations, and QA verification, not regular production users.

To sign in:

The system maps the account name to testuser01@test_account.com automatically, so do not enter the full email address. The button appears only after at least one test account exists on the platform.

First Sign-in and Platform Roles

• If no platform user exists yet, the first account to sign in successfully through Google or Microsoft becomes the Super Admin.
• Later first-time OAuth users receive the default platform role configured in the Admin Panel. The system default is Pending.
• After signing in, Pending users are directed to the pending-access page. A Super Admin or Admin must assign an appropriate platform role before they can use restricted Studio features.
• A test account receives the User or Admin role selected by its creator and is not part of the first-OAuth-user bootstrap flow.

See Accounts and Roles for role details.

Invite Links and Invite Codes

A sign-in URL may contain an invite code. The platform preserves this context before OAuth sign-in and records the invitation source and applicable rewards when it creates a new user.

An invite code does not determine the platform role or automatically add the user to an organization. The platform's default-role setting still controls the initial role, while organization access requires an organization membership invitation.

Deployment Configuration

The Google and Microsoft buttons are controlled by deployment environment settings:

• Google: GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET
• Microsoft: AZURE_AD_CLIENT_ID and AZURE_AD_CLIENT_SECRET
• Microsoft account scope: AZURE_AD_TENANT_ID defaults to common (work, school, and personal accounts). Use organizations, consumers, or a tenant GUID when needed. AZURE_AD_ALLOWED_TENANTS optionally restricts tenant IDs.

The Microsoft app registration must include the account types you intend to allow. In public cloud mode, existing Studio accounts are not automatically linked by matching email; contact an administrator if an existing account needs Microsoft sign-in.

If neither Google nor Microsoft is configured, the sign-in page reports that no OAuth provider is enabled. The test-account button is still controlled independently by whether a test account exists.

Frequently Asked Questions