Getting started

Signing in

Held Open uses email and password sign-in — there’s no SSO, no magic-link, and no public self-signup. Every account is created by someone: the first-run setup below, an admin inviting you as a workspace user, or someone inviting you to collaborate on a specific mailbox.

1. Go to your instance’s sign-in page. You’ll land on Sign in — “Pick up where the queue left off.”
2. Enter your Email and Password, then click Sign in.
3. If your account has two-factor authentication enabled, you’ll be asked for an Authentication code next.
4. After several failed attempts in a short window, sign-in adds a short math CAPTCHA (“Solve this simple sum to continue”) before trying again — on by default, and a workspace admin can turn it off.

There’s no workspace picker — signing in takes you straight into your default workspace. If your account doesn’t belong to one, you’ll land on a “workspace not found” page instead.

Session cookies last 30 days for browser sign-ins (there’s no “remember me” — it’s unconditional), or 90 days for a signed-in mobile app.

Your profile

Two self-service areas are worth knowing about early, both entirely up to you — no admin involved: two-factor authentication under /account/security, and notification preferences under Settings → Notifications.

Two-factor authentication

Enable two-factor starts the flow: you’ll get an actual QR code, plus the setup key as plain text and an otpauth:// link underneath it in case scanning isn’t an option. Point any TOTP authenticator app at whichever one works, enter the 6-digit code it generates, and you’re confirmed.

That done, you get 10 single-use backup codes, shown exactly once — save them somewhere before you close that screen. Each one works once, for when you don’t have your device. There’s no way to see them again or regenerate them short of disabling and re-enabling two-factor from scratch.

Disabling asks for a current code or your account password, not both — whichever you’d rather use.

Notification preferences

Settings → Notifications is a grid: event type down one side, medium — Email or Browser — across the other. Check what you want, save. Ten event types cover new conversations and replies, sliced by whether it’s assigned to you, unassigned, or someone else’s.

Turning on Browser for the first time fires your browser’s own permission prompt. If notifications end up blocked or your browser doesn’t support them, you’ll see a warning under the table instead of things just silently not showing up.

A new account starts from whatever a workspace admin set as the default subscriptions — from here you’re only ever changing your own copy, not that default.

The first admin account

The very first time a Held Open instance runs, nobody has an account yet. A “First run? Create the admin account” link appears on the sign-in page — it only shows up while the instance genuinely has zero users, and disappears the moment setup completes.

That link leads to a single form: company name, your name, email, and password. Submitting it creates your account as a superadmin and signs you straight in. There’s no multi-step wizard and no post-setup checklist — from there you’re in the app, and the next thing worth doing is connecting a mailbox.

Getting invited

If someone else already set up your workspace, you’ll get here one of two ways:

• A workspace invite — an admin adds you under Settings → Users. You get an email with a link to /user-setup/…, where you set your name and password and click Activate my account. The link expires after 7 days.
• A mailbox invite — someone invites you to collaborate on a specific mailbox without necessarily making you a full workspace user first. If you don’t have an account yet, the invite link lets you create one and accept in the same step; if you already do, you’re prompted to sign in and the access is granted then.

Workspaces, in brief

A workspace (the backend calls it a “tenant”) is your team’s whole account — its users, mailboxes, and conversations, isolated from every other workspace on the same instance. Every screen you use lives under a /w/<workspace-slug>/ URL. The slug is set once, by whoever creates the workspace, and can’t be changed afterward — but the display name you see in the app and in outgoing email (Settings → General → Company name) can be changed any time.