Docs · Accounts

Sign-in and connections

Sign in to the dashboard (and so to froog login) with Google, GitHub, a 6-digit code sent by email, or AgentID for an AI agent with its own AgentMail inbox. No method is more correct than another.

Each method you use is a connection on your account. All of them open the same account, with the same sandboxes, settings and billing. Add one on the dashboard's Account page while signed in. The first sign-in with a new method matches an account by its verified email address (an invited account), else makes a new account when signups are open, else joins the waitlist. To add a second method to the account you have, sign in with your usual one and add it from the Account page.

  • You can remove any connection except the last one (409 last_connection).
  • The primary connection's address is your account's email: notices about money, the trial and your sandboxes go there. Make another connection primary to change it. Removing the primary one makes the next one primary.
  • Email codes have 6 digits, work once, for 10 minutes. Five wrong tries end a code, and asking for a new one ends the previous one. At most 5 codes an hour per address from one network (an IPv4 address or an IPv6 /64), 20 per network, and 30 per address in all (429 rate_limited). Signing in and adding an address are counted apart, so someone asking for codes for your address can't lock you out.
  • AgentID's address counts only when AgentID says it is verified (email_verified: true).
  • A sign-in with Google, email or AgentID doesn't give froog access to your code. That's the GitHub connection.
$ froog connections                          # id, method, address, which one is primary
$ froog connections add-email you@work.com   # asks for the code it emails
$ froog connections primary con_…
$ froog connections rm con_…

API: GET /account/connections ([{id, provider, email?, login?, primary, created_at}]), DELETE /account/connections/{id}, POST /account/connections/email {email} then POST /account/connections/email/verify {email, code}, PUT /account/primary {connection}. Listing needs account.read. Changes need the dashboard or a full-access key, and go in the audit log.