Sign-In Methods

Anava Vision supports several ways for your team to sign in, so you can match the experience to how your organization already manages identity. This guide covers what each option looks like for an end user and how administrators set it up.

Overview

The sign-in page offers:

• Continue with Google — sign in with an existing Google account
• Email me a sign-in link — a passwordless link sent to your email address (no password required)
• Password — a traditional email-and-password sign-in, for users who have set one up
• Passkeys — where enabled, sign in with a device passkey instead of a password
• Enterprise SSO (SAML) — sign in through your organization's identity provider, if configured

Whichever method a user signs in with, every user is required to enroll in multi-factor authentication (TOTP) the first time they sign in. See Multi-Factor Authentication for how enrollment and challenges work.

First sign-in for an invited teammate

1. An administrator adds the teammate's email address under Administration → Members & roles.
2. The teammate opens the Anava Vision sign-in page and enters that email address.
3. They receive a sign-in link by email from a sender address in the form noreply@<your-project-id>.firebaseapp.com. If it doesn't arrive within a minute or two, check the spam or junk folder — the sender is unfamiliar the first time it arrives.
4. Clicking the link signs them in directly — no password is needed for this first sign-in.
5. They're prompted to enroll in TOTP multi-factor authentication using an authenticator app. This step is required before they can continue.
6. After enrolling, they're offered the option to set a password for future sign-ins. Setting a password is optional — "Email me a sign-in link" continues to work either way.

Link expired, or never arrived? Return to the sign-in page and use Resend link to send a fresh one. Sign-in links expire after a short window for security, so a link from an older email won't work — always use the most recent one.

Adding a password later: if a teammate skipped setting a password at first sign-in, they can add one at any time from the same offer on their account page, or by choosing Reset password from the sign-in page (which sends a password-setup email even for an account that has never had one).

Continue with Google

There are two ways Google sign-in works, depending on how your tenant was set up.

Included with Anava Vision

Tenants provisioned from a release that includes it can use Google sign-in with no setup at all. Sign-in goes through Anava's own Google application, and the Google consent screen names Anava — this is expected and correct, not a sign of a misconfigured or unofficial integration.

Administrators decide who may use it:

• Only users who have been explicitly invited under Administration → Members & roles, or
• Anyone signing in with an email address on an allowed domain list, configured in Settings

Bring your own Google OAuth client

Organizations that want the consent screen to show their own name and branding instead of Anava's can configure their own Google OAuth client:

1. Go to Settings → Google Sign-In. This opens a guided setup panel.
2. Follow the link to the Google Cloud Console to create a new OAuth client.
3. Choose Web application as the client type.
4. Copy the redirect URI and JavaScript origins shown in the panel, and paste them into the matching fields on your new OAuth client in the Google Cloud Console.
5. Google shows you the client secret only once, at creation time. Download the client JSON (or copy the secret) before closing that dialog — you cannot retrieve it again, and creating a new client is the only recovery if you lose it.
6. Back in the Anava Vision panel, paste in the client ID and secret (or the downloaded JSON).
7. The panel verifies the new provider works. Once verified, the sign-in page offers Continue with Google immediately — no redeploy or waiting period required.

If the panel reports that the setup route is not answering, your deployment predates this feature — upgrade to a current release, or contact support.

Enterprise SSO (SAML)

For organizations that manage identity centrally, Anava Vision supports signing in through a SAML 2.0 identity provider. Set this up from Settings → Enterprise SSO, which walks you through registering Anava Vision as a service provider with your identity provider and mapping the required attributes.

Supported providers include Okta, Azure AD, Google Workspace, and OneLogin, as well as any other standards-compliant SAML 2.0 identity provider.

Passkeys

Where passkeys are enabled for your tenant, they appear as a sign-in option alongside Google and email link on the sign-in page, and can be registered from your account settings. A passkey lets you sign in using your device's built-in authentication (fingerprint, face, or security key) instead of typing a password.

Troubleshooting

Symptom	What to do
No sign-in email received	Check spam/junk first — the sender (noreply@<your-project-id>.firebaseapp.com) is unfamiliar. Use Resend link from the sign-in page. Confirm the address was entered exactly as invited under Administration → Members & roles.
"This link has expired"	Sign-in links are valid for a limited time. Go back to the sign-in page and request a new one — don't reuse an old email.
"This account has no sign-in method set up yet"	The address exists but hasn't completed first sign-in, or a sign-in method was removed. Use Email me a sign-in link to complete setup, or ask an administrator to confirm the address is listed under Administration → Members & roles.
Google button missing	Google sign-in isn't enabled for your tenant, or your account isn't on the allowed list (invited users only, or an allowed domain). Check Settings → Google Sign-In, or ask an administrator.
Consent screen says "Anava" instead of your company name	Expected when using the included Google sign-in. To show your own branding, configure Bring your own Google OAuth client above.
Lost access to authenticator app (MFA reset needed)	Contact an administrator to reset your multi-factor authentication enrollment, then sign in again and re-enroll. See Multi-Factor Authentication.