Sign in

This page walks through what happens when you sign in to Ripllo, what each screen does, and how to recover from the common things that go wrong.

If you're new to Ripllo and don't have an account yet, you can sign up from the same screen — the "Create account" link sits below the password field.

The flow

Sign-in has up to three screens, depending on your account state:

ripllo.com/login — the email + password form, with Google/Apple buttons beside it.
Huudis (only for social sign-in and for MFA-enrolled accounts) — you finish the challenge on huudis.com.
Ripllo dashboard — you're in.

The email/password path never leaves ripllo.com. You type your credentials on Ripllo's own page and Ripllo's backend relays them to Huudis; the address bar stays on ripllo.com the whole way. Huudis still owns identity — it just isn't the surface you type into. You only see huudis.com if you click Google or Apple, or if your account has MFA enrolled.

Step-by-step

The Sign in button is in the top-right of every ripllo.com page. Clicking it sends you to ripllo.com/login, which shows one form — email and password — plus a button per social provider your Huudis instance has configured (typically Google and Apple). There's no separate "how do you want to sign in?" chooser step, and nothing is skipped on repeat visits.

2. Enter credentials

The form is on ripllo.com.

Email is case-insensitive.
Password is case-sensitive. Spaces matter.
Ripllo doesn't impose a length limit on passwords beyond what Huudis enforces (minimum 10 characters).

Submitting posts to Ripllo's backend, which forwards the credentials to Huudis as a password grant. Three possible outcomes:

Success, no MFA — Ripllo sets your session cookie and lands you on /dashboard. You never left the domain.
Success, MFA enrolled — Huudis answers MFA_REQUIRED, and the page redirects you into the Huudis flow to finish (step 3). This is the point where the address bar changes.
Failure — you see "Invalid email or password" with no information about which one is wrong (this is intentional, to prevent account enumeration).

Clicking Continue with Google or Continue with Apple skips this form entirely and sends you straight to Huudis with the provider pre-selected.

3. MFA challenge (if enabled) — on huudis.com

If you've enrolled in multi-factor authentication, Huudis prompts you for a code. Supported factors:

TOTP — from Google Authenticator, Authy, 1Password, etc. Six-digit codes.
WebAuthn — hardware security keys (YubiKey) or platform authenticators (Touch ID, Windows Hello).
Backup code — one of the codes you saved when you enrolled. Each code works once.

Enter the code. Huudis verifies it and proceeds.

Lost your second factor? Use a backup code. If you've used them all, email support@forjio.com from the address on the account — MFA lives in Huudis, and there is no control anywhere in the Ripllo dashboard (or in any workspace-admin screen) that can disable it for you. Don't wait on a teammate who doesn't have that button.

On the email/password path there's nothing to come back from — the session cookie is already set and you're redirected to /dashboard in the same request.

When you did go out to Huudis, it redirects your browser to ripllo.com/callback?code=…. The callback page POSTs that code to Ripllo's backend, which:

Exchanges the code for tokens at Huudis.
Validates the PKCE challenge it stored before redirecting you out.
Signs a session cookie and sets it on your browser.
Redirects you to /dashboard.

You're in. The whole thing usually takes under a second.

Workspace selection

If your Huudis identity belongs to multiple Ripllo workspaces, the first sign-in to a new browser lands you in the workspace you used last. If we can't determine that — e.g., it's a new browser and you're a member of several — we land you in your default and show a brief banner that you can switch.

The workspace switcher lives in the top-left of the dashboard.

"Remember me"

We don't have a "remember me" checkbox because we do it by default. Session cookies last 30 days of inactivity — you don't need to re-sign-in unless you've been away.

The cookie is httpOnly, Secure, SameSite=Lax, and HMAC-signed. It's safe to leave the browser open.

Signing in through Storlaunch

If you got your Ripllo workspace via the Storlaunch marketing module, you don't usually need to sign in to ripllo.com directly — you stay inside Storlaunch's portal, and Storlaunch's backend proxies your actions to Ripllo on your behalf.

You can sign in to ripllo.com directly with the same Huudis account if you want to see the raw Ripllo dashboard. Both surfaces hit the same data — there's no separate ledger.

Common errors

"Invalid email or password"

The email or password you entered didn't match. We don't tell you which one for security reasons. Things to check:

Caps Lock is off.
The email is the one you used at sign-up.
You haven't recently changed your password (then logged in with the old one).

If you genuinely don't remember, use Forgot password.

"Email not verified"

You signed up but never clicked the verification link in the welcome email. The check is Huudis-side, and the sign-in page relays its message.

There is no Resend verification control on the Ripllo sign-in page — the only endpoints behind that form are login, signup, and password reset. Find the original email from no-reply@huudis.com (check spam), or email support@forjio.com and we'll re-trigger it from Huudis.

"Account locked"

After too many failed attempts (we cap at 10 per 15 minutes), Huudis temporarily locks your account. Wait 15 minutes and try again. If you've genuinely forgotten your password, request a reset — that bypasses the lock.

"Too many requests"

The Huudis IdP rate-limits sign-in attempts per IP. If you're behind a NAT with many users (corporate network, shared dev machine), you may share a quota. Wait a minute and retry; the limit resets quickly.

Behind the scenes

If you want to understand the protocol-level details — PKCE, state, nonce, refresh token rotation — the Authentication overview has the longer version.

Forgot password — reset your password.
Authentication overview — the protocol-level picture.
Portal tour — now that you're signed in.