Sign in
The forum is open to invited members, and they sign in on the forum page. Every guide, prompt and course page can be read today without an account. Course sign-in opens later. It will remember your lesson and the work you choose to save, through your email or an account you already have at Google or GitHub.
Forum
Invited to the forum? Sign in there.
Beginner
A code in your inbox, or a site you already use
The sign-in form will open on this page.
You type an email address. Polaris sends either a magic link, a one-time web address, or a one-time PIN, a short code, to that inbox. Opening the link or typing the code shows that you can read the mail. The site will not ask you to invent a password, and it will not store one. Cloudflare documents the same pattern for its one-time PIN: each code works once, a new code cancels the previous code, and in that product the code expires ten minutes after the request. Some mail filters open links automatically. If the page says the code was already used, request another and check spam.
Google and GitHub are the other path. OpenID Connect is the standard that lets Polaris ask one of those sites to confirm who you are, and to pass along a few facts you agree to share, such as your email. Your password for Google or GitHub stays with them.
After sign-in, the foundation course can store the lesson you stopped on and open there next time. Until then, stay in the same browser and keep your own notes.
Explain this sign-in to me
I have never used a passwordless login. Explain a magic link and a one-time PIN in plain words, using an email inbox as the example. Then list three things I should check if the code never arrives, or if the page says the code was already used. Define any term before you use it, including OpenID Connect, and keep the steps short enough to follow on a phone.
Intermediate
What the account keeps, and how you end a session
The account is a shelf for work you choose to keep: job posts you saved, topics you watch, unpublished drafts, prompts you want again, and bookmarked guides. A prompt is the instruction you give a model. A watch means you asked to be told when a thread or a guide changes. You decide what is kept there.
The same page lists sessions. A session is one signed-in browser or app, with the time it started and a rough network address, so you can tell your laptop from a machine you do not recognize. Ending a session signs that device out, including one left at work. OpenID Connect names this RP-Initiated Logout: Polaris asks the identity provider to end the login too. The provider should ask you before it also signs you out of Google or GitHub. Ending a Polaris session leaves your drafts in place.
On GitHub, the consent screen lists scopes. A scope is a named permission. For sign-in, the ask should be read access to your profile and email, read:user and user:email. The repo scope can read and write code, so it does not belong on a sign-in button. GitHub lets you grant less than the app requested, and you can reduce the grant later in GitHub's own settings. A later feature that needs more access has to ask again, and you can say no.
To get back in, request a new code to the same address.
Read a GitHub consent screen
I am about to sign in to a free learning site with GitHub. The consent screen asks for these scopes: [paste the scope names here]. For each scope, say what GitHub allows, whether a site that only needs my name and email should ask for it, and what I should refuse. Use GitHub's own scope names, including read:user, user:email, and repo. Remind me that I can grant less than the app requested and change that later in GitHub settings.
Expert
The record, the rights, and three different tokens
The privacy notice will list a small account record: your email, the time of each sign-in, and the IP address of that sign-in. An IP address is the network number of the connection, so the session list can show where a login came from. The notice will also say that prompt text is kept so you can rerun your own jobs, and that this text is not collected in order to sell it.
IMY, the Swedish Authority for Privacy Protection, sets out the GDPR rights against whoever holds that record: to be told what is kept and why, to receive a copy, to correct a mistake, to request erasure in the cases the law lists, to limit processing, to object to some uses, and in some cases to take data you provided to another service. Download my data and Delete my account start those two requests. The notice, not this guide, names the controller and says what deletion removes and what a short log must keep.
When the shared machine takes bookings, the account shows your queue place and a budget of model tokens or minutes. A model token is a piece of text the model counts. An access token is separate: a short-lived proof that this browser may call Polaris. A script key is a third secret. The site should keep only a hash of that key, and revoking it should leave the browser session running. The EU AI Act's transparency rules say the chat page should tell you when you are talking to a machine.
Review this account design
Review this planned account against OpenID Connect Core 1.0, OpenID Connect RP-Initiated Logout 1.0, GitHub OAuth scopes, and the GDPR rights described by the Swedish Authority for Privacy Protection (IMY). Design: email one-time code, or Google or GitHub sign-in; store email, sign-in time, and IP address; session list with remote sign-out; buttons labeled Download my data and Delete my account; a revocable script key stored only as a hash; a queue place and a compute budget; prompt text kept so the person can rerun their own jobs and not collected in order to sell it. List gaps, the ID token claims iss, sub, and aud, the smallest GitHub scopes for sign-in, and the sentences the privacy notice must include. Treat erasure as a legal request with the exceptions IMY lists, and do not invent a live user base or a machine already in service.
Steps on the sign-in form
- Choose email, Google, or GitHub.
- For email, enter the address and ask for a code or a link. Use it once. If you need another, the new one replaces the old one.
- For Google or GitHub, read the consent screen. Sign-in needs your name and email. It does not need access to your repositories.
- After accounts store progress, you return to the lesson where you stopped.
- On the account page, end any session you do not recognize. That signs out the device and leaves drafts where they are.
- Download my data sends you a copy. Delete my account starts an erasure request. The privacy notice states what is removed and what a short log must keep.
Messages you may see when signing in
| What happened | What the form says |
|---|---|
| The address has no @ | That does not look like an email address. Check it and try again. |
| A code was requested | A code is on its way to that address. It works once. If nothing arrives, check spam, then request a new code. A new code cancels the old one. |
| The code was already used | That code was already used. A mail filter may have opened the link. Request a new code. |
| The code does not match | That code does not match. Request a new one. |
| You ended this session from the account page | This session was ended from your account. Request a new code to continue. |
| GitHub or Google returned you without an approval | Sign-in stopped because the consent screen was closed. You can try again, and you can approve a smaller set of permissions. |
What you can do before and after accounts
| Item | Today | When accounts open |
|---|---|---|
| Read the guides | Open to everyone | Open to everyone |
| Course position | Keep your own notes | Saved on the account, on your next device |
| Saved jobs, watches, drafts, prompts, bookmarks | Not available | On the account |
| Session list and remote sign-out | Not available | On the account |
| Copy of your data, and erasure | Email the address in the privacy notice. | Download my data and Delete my account |
| Queue place, compute budget, script key | The shared machine is not in service | Shown on the account |
A shared community DGX Station would put a queue place and a compute budget on this account, for fine-tuning and inference on a deskside machine the community runs. About the shared station
Sources
- OpenID Connect Core 1.0The identity layer on OAuth 2.0: how a site checks who you are, and the ID token claims iss, sub, and aud. The OpenID Foundation asks for attribution if the specification text itself is reproduced. This page only summarizes it.
- OpenID Connect RP-Initiated Logout 1.0How the site you are leaving asks the identity provider to log you out, and why the provider should confirm before ending the wider Google or GitHub session. Same OpenID Foundation license note as the Core specification.
- Cloudflare One: one-time PIN loginA worked example of email sign-in: single-use codes, a new code cancelling the old one, a ten-minute expiry in this product, and mail filters that open the link first.
- GitHub: building an OAuth appHow an application registers with GitHub so people can authorize it. GitHub notes that GitHub Apps, with finer permissions, are preferred to classic OAuth apps.
- GitHub: scopes for OAuth appsWhat each permission name allows. read:user and user:email cover profile and email. The repo scope reaches code. People can grant less than the app asked for.
- IMY: your rights as a data subjectThe Swedish Authority for Privacy Protection on GDPR rights: information, access, rectification, erasure and its limits, restriction, objection, and data portability. If the English page and the Swedish page differ, IMY says the Swedish version applies.
- European Commission: AI ActThe EU legal framework for AI, including the transparency duty to tell a person when they are interacting with a machine such as a chatbot.
- NVIDIA DGX StationNVIDIA's product page for the deskside DGX Station: a machine for building, fine-tuning, and running AI models locally. Polaris does not have this machine in service yet.