Where a sign-in should leave you: the app you hold, not a lobby

When one account opens several products, the last step of signing in becomes a question with a wrong answer available: where do we put this person now?

Ours answered it by looking at organizations. Belong to one, and you were sent to the customer console. That is right for a customer and wrong for everybody else — and it showed. Somebody whose only role is running the platform signed in and landed on a page offering an account, an organization to manage, and a way to sign out again: three things, none of which was what they held.

The shortcut is about the app, not the organization

The rule is now simple enough to say in a sentence: if there is exactly one app this deployment knows an address for and you hold it, you go straight there. Anything else — none, or several — and you arrive at the hub.

The hub changed with it. It used to list the apps you hold as plain text and link every organization to the customer console, which produced the worst possible page: the one app your account could open was named on screen and could not be opened from it. Now each app is its own row with its own link, and the row you want is the one you click.

Addresses come from settings, never from a pattern

There is a tempting shortcut here that we keep refusing. Every app has a key — relay, partners, console — and it would be easy to build an address from it and hope. A guessed hostname that happens to be wrong is a broken link with our padlock on it, sent to somebody who has just proved who they are; and on a customer’s own installation, the hostnames are the customer’s business, not ours to guess.

So an app’s address is configuration. If a deployment has not been told where an app lives, that app stays a name on the hub without a link — visible, honest, and not a dead end dressed as a door. It is the same rule the whole estate follows about pages telling you what they are: say what is true, including when the true thing is “not configured here”.

A hostname guessed from an app key is a broken link with our padlock on it.

And if you were going somewhere

All of that is the answer when a sign-in has no destination of its own. Most sign-ins do: you clicked something in a console, or followed a link into the Relay, and the sign-in carries that destination through and returns you to it — provided it is on the list of places a sign-in may end, which is its own story.

The hub is what you get when nothing sent you: a plain list of what this account opens, on the deployment you are signed in to, with a link on everything that has one.