Signing in with KingsChat

What it is

KingsChat sign-in lets you use your KingsChat identity instead of a password. You do not create a password for Formwork, and Formwork never sees your KingsChat password. It asks KingsChat to confirm who you are and reads your profile: your name, your username and, if there is one, your email address.

Signing in for the first time

On the sign-in or create-account page, choose Continue with KingsChat. You go to KingsChat's own sign-in page, approve, and come back to Formwork signed in.

• If this KingsChat account has been used here before, you are signed in to that account.
• If it has not, a new Formwork account is created with your KingsChat name, together with a personal workspace.
• If your KingsChat profile has an email address, it becomes your account email. If it has none, the account is created without one.

If your KingsChat email address matches an account that already exists here, Formwork does not connect them automatically. You see "An account with that email already exists. Sign in with your password, then connect KingsChat from Account settings." The reason is that Formwork cannot be sure that email address belongs to the same person, and joining accounts on a guess would let someone take over another person's account.

Connecting KingsChat to an existing account

1. Sign in with your usual method.
2. Open Account and security and go to Connected accounts.
3. Choose Connect KingsChat and approve on KingsChat.

Afterwards the section says "Connected as @username. You can sign in with it." A KingsChat account can be connected to only one Formwork account. You get "That KingsChat account is already connected to another user." if it is taken, and "Your account already has a different KingsChat account connected. Disconnect it first." if you try to add a second one.

To remove the link, choose Disconnect. You need a password on the account first, otherwise you would lock yourself out, and Formwork says so: "Set a password before disconnecting KingsChat, or you would be locked out."

Accounts without an email address

Some KingsChat profiles have no email. Such an account works, but there are things it cannot do until you add an address under Email on the Account page:

• receive emails such as new-response notifications, digests and security notices, which Formwork skips for accounts without an address;
• sign in with an emailed link, or reset a password by email;
• be invited by email.

Formwork lists such members as "KingsChat" with their username in workspace member lists, and as "KingsChat account" on a form's sharing page, since there is no address to show.

Adding an email later is the same as changing it: enter the address, select Send confirmation, and open the link that arrives.

Setting a password

Under Password the section reads Set a password. Add one to sign in with your email and password as well, and to be able to disconnect KingsChat.

When something goes wrong

Sign-in pages show a short message if the KingsChat step fails:

Security

Formwork checks every KingsChat login by asking KingsChat itself who the token belongs to. A token that is forged, expired or made for someone else is rejected. The sign-in attempt is bound to a signed, time-limited state that is created when you press the button, so a link from elsewhere cannot complete a login for you.