Logging In
Legitt AI supports three ways to sign in, plus a recovery path if a password is forgotten.
Method 1: Email + Password Login
Precondition: the user has an active account and is on the Sign In screen.
Email + Password Login Steps
Step 1 — User enters their registered email. Format is validated in real time.
Step 2 — User enters their password. Input stays masked.
Step 3 — User can optionally toggle Remember me, setting a session persistence preference.
Step 4 — User clicks Continue. Credentials are validated against the account.
Step 5 — Legitt AI verifies credentials. If valid, an authenticated session is created.
Step 6 — Legitt AI redirects the user. They land on their workspace / dashboard.
End state: user is authenticated, session is active, and they are on the dashboard.
Method 2: SSO / Social Login
Supports Google, Microsoft, Salesforce, and enterprise SSO providers.
Precondition: the account is already linked to the chosen provider, and the user is on the Sign In screen.
SSO / Social Login Steps
Step 1 — User clicks a provider button. This initiates the provider's OAuth / SSO redirect.
Step 2 — User authenticates with the provider and grants consent. The provider returns a verified identity token.
Step 3 — Legitt AI receives the token and matches it to an existing account. If matched, an authenticated session is created.
Step 4 — Legitt AI redirects the user. They land on their workspace / dashboard.
If no linked account is found for the verified identity, the user is routed to sign up or offered the option to link an existing account instead of failing silently.
End state: user is authenticated via the provider, and their session is active.
Method 3: Forgot Password (Account Recovery)
Precondition: the user has an account and is on the Sign In screen.
Forgot Password Steps
Step 1 — User clicks Forgot password?. This opens the reset-request page.
Step 2 — User enters their registered email and submits. A generic confirmation is shown, without revealing whether the account exists.
Step 3 — Legitt AI sends a one-time password to the registered email.
Step 4 — User enters the OTP. Once matched, the token is verified and the set-new-password page opens.
Step 5 — User enters a new password that meets the strength rules and confirms it. This updates the password and invalidates old sessions.
Step 6 — User returns to Sign In and logs in with the new password. Authentication succeeds.
End state: the password is reset, and the user can sign in with the new credentials.
Login Errors & Alternate Paths
Every failure branch is designed to end in a clear, safe message — never a leak, a crash, or a dead end.
| Scenario | System Response | Notes |
|---|---|---|
| Valid email + wrong password | Generic "invalid credentials" message; no session created; attempt is counted | Never say "wrong password" specifically |
| Email with no matching account | Same generic "invalid credentials" message | Must not reveal whether the email exists |
| Too many failed attempts | Account is locked / throttled; cool-down or CAPTCHA is shown | Rate-limiting applies |
| Correct credentials but email unverified | User is prompted to verify their email, with an option to resend the link | — |
| SSO login with no linked account | User is routed to sign up, or offered the option to link an existing account | Shown as a "link account" call to action |
| Expired reset link is clicked | "Link expired" message is shown, with an option to request a new one | — |