Skip to content
Fito

Create an account and sign in

You browse Fito’s catalogue and its Knowledge area without an account. You need one to record proficiency, to see your own assessments, and to submit a case.

This page covers the web app. Logging in from your terminal is a separate step that reuses the same account — Log in from the terminal.

Create an account

Section titled “Create an account”

  1. Open the web app and go to /auth/signup.

  2. Fill in the four fields:

    Field Rule
    Full name Required
    Username Required, at least 3 characters
    Email Required, and not already registered
    Password Required, 8 to 100 characters

  3. Click Create account.

You are signed in as soon as the account exists — there is no confirmation email to wait for.

If the email is already registered, the form shows Email already in use. Sign in with it instead, or use another address.

Sign in

Section titled “Sign in”
  1. Go to /auth/login.
  2. Enter your email and password.
  3. Click Log in.

A wrong email or a wrong password both return the same message, Invalid email or password. That is deliberate: a different message for each would tell a stranger which emails have accounts.

Continue with GitHub

Section titled “Continue with GitHub”

The login page also offers Continue with GitHub. It does two different jobs depending on whether you are already signed in.

  • Signed out, it is a sign-in. GitHub tells Fito who you are, and you land in an account keyed to that GitHub identity.
  • Signed in, it is a link. Your existing Fito account gains a GitHub identity and keeps everything already on it.

Fito asks GitHub for read:user and user:email, and nothing more. That scope can read your public profile and your email address. It cannot push code, create a fork, or open a pull request — your own local gh does all of that.

If the button does nothing at all, the Fito server you are using has no GitHub OAuth application configured. That is a server-side setting, not something you can fix from your side.

What your session is made of

Section titled “What your session is made of”

Signing in mints two tokens, and they have different jobs and different lifetimes.

Token Lives for What it does
Access token 15 minutes Authorizes each request you make
Refresh token 30 days Buys a fresh pair when the access token expires

Two properties are worth knowing:

  • The server stores only a hash of your refresh token. A copy of the database does not yield a usable session.
  • Using a refresh token rotates it. The old one stops working the moment a new pair is issued, so a stolen token has a short and detectable life.

Signing out revokes the refresh token on the server rather than only forgetting it in your browser.

An operator can change both lifetimes, so a hosted Fito may not use the numbers above. Your own session simply expires; nothing you do changes because of it.

Confirm you are signed in

Section titled “Confirm you are signed in”

Open any case cover at /cases/<id>. Signed in, each prerequisite carries a You have this or Missing badge, which a visitor never sees. Once a submission of yours on that case is evaluated, the Competencies assessed section shows your own result too. Neither appears when you are signed out.

If you work from a terminal, the API answers directly. GET /me answers with your identity:

{
  "userId": "019f234e-ce7a-7871-8ea0-146e1ae2fd9d",
  "email": "[email protected]",
  "username": "demo",
  "githubLogin": null,
  "githubUserId": null,
  "curator": false,
  "admin": true
}

githubLogin is null until you link GitHub. That is the field /fito-submit checks.

What’s next

Section titled “What’s next”