Onboarding & Account Setup

Everything that happens between "Sign up" and your first campaign send

The Three Sign-Up Paths

Superkabe supports three ways to create an account. The path you take depends on what kind of email address you sign up with — the backend branches on Google's hd (hosted-domain) claim to decide whether your organization can be auto-derived or whether we need to ask you to name it.

1. Email + Password

The classic flow. Visit /signup and submit three things: email, password, and an organization name. The backend creates a User and Organization row, hashes your password, sends a verification email via Resend, and sets your JWT cookie. You land on the dashboard immediately — verifying your email later is a soft requirement.

2. Google OAuth — Workspace Account

If you sign in with Google and your account is on a custom domain managed by Google Workspace, Google returns an hd claim with your domain (e.g. acme.com). Superkabe treats that domain as the canonical organization identity: it derives an org name from the domain, creates the org and user, issues your JWT, and redirects to /dashboard. No extra step.

3. Google OAuth — Personal Gmail

If your Google account is a plain @gmail.com address, Google sends back hd: undefined. The backend creates a PendingRegistration record (encrypted tokens, 10-minute TTL) and bounces you to /onboarding. That page asks for one thing: a name for your organization. Once submitted, the backend reads back the pending record, creates the User + Organization, issues your JWT, deletes the pending row, and lands you on /dashboard.

Why Personal Gmail Goes Through /onboarding

A Workspace account has a verified domain, and that domain is what Superkabe uses as the organization's identity (it's also what we'll later attach mailboxes, DNS records, and team members to). A personal Gmail address has no such domain — every gmail.com user shares the same root domain, so we can't derive anything meaningful from it.

Without an explicit naming step, every gmail.com signup would either crash on a uniqueness constraint or default to a generic placeholder like "Personal" — both bad UX. The pending-registration handoff is the cleanest fix: we hold the verified Google identity for 10 minutes while you finish naming your org, then commit everything in a single transaction.

Google OAuth callback
        │
        ▼
  Inspect googleUser.hd
        │
   ┌────┴─────────────┐
   │                  │
   ▼                  ▼
hd = "acme.com"   hd = undefined
(Workspace)       (Personal Gmail)
   │                  │
   ▼                  ▼
Derive org name    Create PendingRegistration
from domain        (encrypted tokens, 10-min TTL)
   │                  │
   ▼                  ▼
Create User+Org    Redirect → /onboarding
Issue JWT                 │
   │                      ▼
   ▼               User submits org name
/dashboard                │
                          ▼
                   Read pending → create User+Org
                   Issue JWT, delete pending
                          │
                          ▼
                       /dashboard

What Happens During Sign-Up

Regardless of which path you take, the backend runs the same six steps inside a single transaction:

Terms of Service & Privacy Acceptance

Both signup paths require accepting the current ToS and Privacy versions before the account is created. The backend rejects any signup that doesn't carry the correct version numbers in its payload — the checkboxes on the form aren't cosmetic.

Acceptance is recorded as two rows in audit_consent, one per document, with the version number, document path, IP, user-agent, and timestamp. The table is append-only — we never mutate or delete consent records.

First-Time Setup Checklist

Once you're on the dashboard, here's what to do in your first thirty minutes — in order:

Trial Mechanics

Every new account starts on a 14-day trial with no credit card required. During the trial you have full access to the platform — connect mailboxes, run campaigns, use protection in ENFORCE mode, everything.

When the trial ends and you haven't picked a plan, the account auto-downgrades to a trial-expired state. Sending is blocked (the sequencer refuses to dispatch new emails) but reading is not — you can still log in, view dashboards, and download data. An upgrade prompt appears throughout the UI pointing to /pricing.

Account Roles

When you sign up, you are the only user in your organization, with role admin. Add team members at /dashboard/settings/team.

Troubleshooting Common Signup Issues