Sign In and Sign Out of Workspaces

Select Log in. After you sign in, Workspaces returns you to the page where you started. Hosted Workspaces lets you sign in with Google, GitHub, Microsoft, Apple, or an email magic link. A self-hosted instance uses the OIDC provider or Cloudflare Access that its administrator set up.

Start sign-in

Select Log in from the signed-out page.

Complete the provider screen

On hosted Workspaces, choose Google, GitHub, Microsoft, Apple, or an email magic link. On a self-hosted instance, sign in with the OIDC provider or Cloudflare Access that its administrator set up. Use the same method each time. To switch accounts, sign out of the provider first.

Check the account

Workspaces returns to your prior page. Open Settings and select Account. The page shows Signed in as and Display name.

Sign out

Use either control:

Open the sidebar and select Log out.
Open Settings > Account and select Sign out.

Hosted Workspaces ends your Workspaces session and sends your browser to AuthKit to finish signing out. An OIDC instance also tries to end the provider session. If the provider does not support sign-out, that session may stay active. On a Cloudflare Access instance, Sign out opens Cloudflare’s sign-out page. Signing out does not revoke your API keys. Revoke each key you own under Settings > API keys before an administrator disables your account at the sign-in provider. If they disable your account first, they must restore sign-in so you can revoke the keys. Only the key owner can revoke a key.

Result	What to do
`401 unauthorized` after the provider screen	Select Log in again. If hosted sign-in still fails and the operator sees WorkOS `invalid_client`, the operator must use a client ID and API key from the same WorkOS application and environment. They must set the redirect URI to the Workspaces app origin followed by `/auth/callback`.
Couldn’t reach Workspaces	Select Try again. If it fails again, check your network. The instance operator should check the Workspaces service, `/v1/auth/config`, and `/v1/me`.
Workspaces opens the signed-out page again	Select Log in to start a new session. The old session may be missing, invalid, expired, or unusable because the operator changed the session-cookie key.
Selecting Log in signs you in again without asking for credentials	Sign out of the sign-in provider, then select Log in to switch accounts. Workspaces ended its own session, but the provider session stayed active. Some OIDC providers do not support sign-out.

Troubleshoot sign-in covers hosted callback errors, self-hosted OIDC discovery, and Cloudflare Access setup. Reviewed July 20, 2026. Maintained by the Plannotator documentation team.

Start

Accounts and organizations

Sharing and access

Documents and collaboration

Agents and developer access

Plans, billing, and seats

Self-hosting and updates

Security and privacy

Troubleshooting

Sign out

​Sign in

​Sign out

​Fix sign-in errors

Sign in

Sign out

Fix sign-in errors