Sign in safely
Review an Unbound sign-in request and decide whether to approve it.
When you see an Unbound sign-in screen, an app is asking for permission to access your information. Take a quick moment to check who is asking and what they want before you click anything.
1. Verify the app's address
The request will show the app's web address (like https://app.example.com).
Make sure this is the website you actually intended to use. Keep an eye out for misspellings, strange subdomains, or completely unrelated websites. If the address looks suspicious, cancel the request immediately and go back to the app using a bookmark or an address you trust.
Evaluate the destination app
Just because an app uses Unbound to sign in doesn't automatically mean it's trustworthy. Unbound simply tells the app who you are—it's up to you to verify if the app itself is safe to use.
2. Choose a provider
If you aren't already logged in to Unbound, you will see options to sign in with services like Google, GitHub, or Discord (depending on what is available).
When you choose one, you'll be sent to that provider's official website to log in. Always double-check their web address before entering your password. Unbound never asks you for a password directly, and it doesn't control your account on those services.
If you are already logged in to Unbound, you will skip this provider choice and go straight to reviewing what the app is asking for.
3. Review what they’re asking for
The app might ask for different types of information:
| Request | What it means |
|---|---|
openid | This is just a standard technical permission required to prove your identity. |
profile | The app is asking for your name and profile picture. |
email | The app is asking for your email address and whether it has been verified. |
Remember, your provider will only send this information if it is actually available on your account. You should only approve these requests if it makes sense for the app to need them.
4. Approve or deny
Click Allow only if you recognize the app's address and feel comfortable sharing the requested information. Click Cancel if the request catches you by surprise, asks for too much, or if you simply clicked a link you aren't sure about.
If you click Allow, Unbound tells the app who you are, and you get signed in. If you click Cancel, the app is told that access was denied, and you will not be signed in.
If something goes wrong
For security reasons, the sign-in process happens quickly and connections are temporary. If you take too long, or if you see an error like "expired code" or "invalid state":
- go back to the app using a safe, known address;
- click their log-in button to start over; and
- try to finish the process in the exact same browser tab.
Don't just keep hitting the refresh button on the error page or try to share the error link with anyone. The easiest and safest way to fix these issues is simply to start the sign-in over.
For more details on how your data is handled, check out Privacy and control.