> ## Documentation Index
> Fetch the complete documentation index at: https://help.plannotator.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign In and Sign Out of Workspaces

> Sign in to hosted or self-hosted Workspaces, sign out, and switch accounts. Hosted sign-in supports Google, GitHub, Microsoft, Apple, and email magic links.

Select **Log in**. After you sign in, Workspaces returns you to the page where
you started.

Hosted Workspaces lets you sign in with Google, GitHub, Microsoft, Apple, or an
email magic link. A self-hosted instance uses the OIDC provider or Cloudflare
Access that its administrator set up.

## Sign in

<Steps>
  <Step title="Start sign-in">
    Select **Log in** from the signed-out page.
  </Step>

  <Step title="Complete the provider screen">
    On hosted Workspaces, choose Google, GitHub, Microsoft, Apple, or an email
    magic link. On a self-hosted instance, sign in with the OIDC provider or
    Cloudflare Access that its administrator set up. Use the same method each
    time. To switch accounts, sign out of the provider first.
  </Step>

  <Step title="Check the account">
    Workspaces returns to your prior page. Open **Settings** and select
    **Account**. The page shows **Signed in as** and **Display name**.
  </Step>
</Steps>

## Sign out

Use either control:

* Open the sidebar and select **Log out**.
* Open **Settings** > **Account** and select **Sign out**.

Hosted Workspaces ends your Workspaces session and sends your browser to AuthKit
to finish signing out. An OIDC instance also tries to end the provider session.
If the provider does not support sign-out, that session may stay active. On a
Cloudflare Access instance, **Sign out** opens Cloudflare's sign-out page.

Signing out does not revoke your [API keys](/workspaces/agents/api-keys).
Revoke each key you own under **Settings** > **API keys** before an administrator
disables your account at the sign-in provider. If they disable your account
first, they must restore sign-in so you can revoke the keys. Only the key owner
can revoke a key.

## Fix sign-in errors

| Result                                                                 | What to do                                                                                                                                                                                                                                                                                      |
| ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `401 unauthorized` after the provider screen                           | Select **Log in** again. If hosted sign-in still fails and the operator sees WorkOS `invalid_client`, the operator must use a client ID and API key from the same WorkOS application and environment. They must set the redirect URI to the Workspaces app origin followed by `/auth/callback`. |
| **Couldn’t reach Workspaces**                                          | Select **Try again**. If it fails again, check your network. The instance operator should check the Workspaces service, `/v1/auth/config`, and `/v1/me`.                                                                                                                                        |
| Workspaces opens the signed-out page again                             | Select **Log in** to start a new session. The old session may be missing, invalid, expired, or unusable because the operator changed the session-cookie key.                                                                                                                                    |
| Selecting **Log in** signs you in again without asking for credentials | Sign out of the sign-in provider, then select **Log in** to switch accounts. Workspaces ended its own session, but the provider session stayed active. Some OIDC providers do not support sign-out.                                                                                             |

[Troubleshoot sign-in](/workspaces/troubleshooting/sign-in) covers hosted
callback errors, self-hosted OIDC discovery, and Cloudflare Access setup.

*Reviewed July 20, 2026. Maintained by the Plannotator documentation team.*