OAuth callback page

Third party app authorization card listing granted scopes and explicit exclusions, the acting account, and authorize or cancel actions with a revoke note.

Centered auth card prompting passkey enrollment with three benefit rows, a device save target panel, and a skip fallback that keeps the existing password active.

A forced password rotation gate with current and new password fields, a policy panel explaining the deadline, and a reset by email fallback.

New password form reached from a reset link with a requirements checklist, a session sign out panel, and the note that nothing changes until save.

Calm session timeout screen that promises local draft restore and prefills the email for one click return.

SSO first sign in with the password fallback and honest reset link timing.

Workspace signup with SSO buttons first, slug preview, and plain 14 day read only trial terms.

Rounded account-creation card with labeled inputs, password guidance, validation feedback, submit state, and sign-in route.

SSO failure page with the specific error reason, a named admin contact, numbered steps to resolve, and retry plus password fallback actions.

SSO-enforced sign in card with org domain shown, a single Continue with SSO button, and a named admin fallback for lockouts.

TOTP verification with six OTP slots, device trust checkbox, backup code link, and human recovery promise.

Check-your-inbox state showing the sent address, a throttled resend button, a change-email link, and the 24-hour expiry note.