Create your account

How-to guide.

This page shows you how to create a MaShop account and how to sign back in. MaShop supports four ways in: email and password, a magic link, GitHub OAuth, and Google OAuth. After your first sign-in you can add two-factor authentication. Every method lands you in the workspace at /projects.

Sign up with email and password

Go to /signup. The form asks for four things: first name, last name (optional), email, and a password. Your password must be at least 8 characters. The strength meter rewards 12 or more characters, an uppercase letter, and a digit, but 8 is the hard minimum the server enforces.

1. Fill in your first name, email, and password.
2. Check the box to accept the Terms and Privacy Policy. The button stays disabled until first name, a valid email, a password of 8 or more characters, and this box are all set.
3. Click Create my account.

MaShop creates your account and sends a confirmation email. Email confirmation is required: you cannot sign in until you click the link in that email. The form then sends you to /auth/verify-email, which shows the address you used and offers a Resend link button.

If the email does not arrive

• Check your spam folder. Delivery can take one to two minutes.
• On /auth/verify-email, click Resend link. The button then counts down a 60 second cooldown before you can resend again.
• If you see This email is already in use. Sign in instead., the address already has an account. Go to /login.

Sign in with email and password

Go to /login, enter your email and password, and click Sign in. On success you go straight to your workspace, or back to whatever page sent you to the login screen.

The Stay signed in on this device for 30 days checkbox is on by default. Leave it on to keep a long-lived session for about 30 days. Uncheck it to make the session end when you close the browser.

Reset a forgotten password

On /login, click Forgot? next to the password field. Enter your account email and click Send the link. MaShop emails a reset link that is valid for 30 minutes and returns you to /auth/reset-password to choose a new password.

Sign in with a magic link

On /login, type your email into the email field, then click Continue with a magic link. MaShop emails you a one-time sign-in link. The button changes to Link sent. Check your email. Open the email and click the link to land in your workspace. No password is needed.

Sign in with GitHub or Google

Both /signup and /login show two OAuth buttons at the top: GitHub and Google. These are the only OAuth providers MaShop wires for account sign-in.

1. Click GitHub or Google.
2. Authorize MaShop on the provider screen.
3. The provider returns you to /auth/callback, which exchanges the sign-in code for a session and redirects you to your workspace.

If a provider is not turned on for your environment, you see github sign-in isn't enabled yet. or the equivalent for Google. The callback also reports three stable failure cases, each shown as a short message on the login page:

Cause	What you see
Provider returned without a sign-in code (you cancelled the prompt)	Sign-in interrupted. Try again from your provider.
The sign-in link expired or was already used	Sign-in link expired. Start over from the provider.
The auth server could not be reached	Auth server unreachable. Try again in a moment.

Turn on two-factor authentication

Two-factor authentication (2FA) is optional and added after your first sign-in, not during signup. Once you are signed in, go to /auth/setup-2fa. The flow uses a time-based one-time password (TOTP) authenticator app such as Google Authenticator, Authy, 1Password, or Microsoft Authenticator.

1. Click Get started. MaShop generates a QR code and a setup secret with the issuer name MaShop.
2. Scan the QR code with your authenticator app, or click Show and copy the secret manually.
3. Click I scanned it, continue, enter the 6-digit code your app shows, and click Verify.
4. MaShop generates single-use backup codes. Copy and store them. They are shown only once and each one works only once if you lose your authenticator.

After 2FA is on, every sign-in adds one step. Once your email and password are accepted, the login route sends you to a 6-digit verification screen at /login. Enter the code from your authenticator and click Verify. If the code is not exactly six digits you see The code must be 6 digits.

If you lose your authenticator

On the verification screen, click Use a recovery code instead. Enter one of the backup codes you saved at setup, in the format XXXX-XXXX-XX, and click Verify. Each code is consumed on use. Dashes, spaces, and letter case do not matter; the server normalizes the code before checking it. Repeated 2FA attempts are rate-limited and show Too many attempts. Try again in 15 minutes.

Where you land

Every successful sign-in sends you to your workspace. By default that is the project list at /projects. If a link sent you to the login page with a ?redirect= or ?next= path, you return to that page after signing in instead. On the same device, a fresh login may take you straight back to the last project you had open.