Getting started

Before you start

Use company sign-in

If your organization has configured an identity provider, open its workspace address and choose the company sign-in option. You do not need to register a personal Mozaic account. Complete your provider’s authentication and any requested recipient proof for an invitation, then enter the organization directly.

This identity belongs only to that organization. It has no Mozaic password, cannot create or enter another organization, and is not linked to a personal account sharing its email. Contact your company administrator for provider access; Mozaic password recovery does not create company credentials. See company sign-in and authentication policy for revalidation and MFA behavior.

The following registration and organization-creation steps apply to personal accounts.

Create and verify the account

1. Enter your identity.Provide a display name and the email address that will identify your account.
2. Choose a long password.Use at least 15 characters. Mozaic rejects common or known-breached passwords.
3. Submit registration.The confirmation response is deliberately generic so it does not reveal whether another person already uses an address.
4. Open the verification link.Use the token from the verification email. If it expires or never arrives, return to Verify email, enter the address, and choose Resend verification.
5. Sign in.Mozaic first checks the browser's existing session and reuses it when it is still valid. Otherwise, enter the verified email and password. You return to the safe in-product destination that originally sent you to sign-in. To use another account, open Account › Security and choose Sign out of this account; other listed sessions remain independently manageable. Sensitive actions still require their own fresh identity check.

Enroll strong authentication

Organization owners and other sensitive workflows require a recent strong-authentication check. Choose either method:

Passkey

Use Windows Hello, Touch ID, a phone, or a hardware security key. Follow the device prompt and return to Mozaic when it completes.

Authenticator

Scan the QR code or enter the displayed secret manually, then provide the current six-digit code.

Recovery

Save the generated single-use recovery codes outside Mozaic. They are displayed once. Choose Download recovery codes to save a private text file, and keep it in a safe place. During onboarding, Security stays open until you choose I saved my recovery codes, then continues to Organization.

When Mozaic asks for fresh authentication later, choose Verify identity. A focused page offers the methods enrolled on your account: a passkey or security key, an authenticator code, or an unused recovery code through the explicit fallback. A successful check remains fresh for a short security window and resumes the requested workflow.

To manage an enrolled authenticator later, return to Account › Security. The page shows that an authenticator is already configured and lets you remove it after a fresh identity check. Removing your last primary MFA method also clears your recovery codes and leaves the account without MFA enrollment; you can enroll an authenticator again from this page.

Create the organization

1. Enter the organization name.This is the ownership and governance boundary for members, teams, projects, content, and billing.
2. Confirm the URL slug.The slug becomes part of the workspace address. Use lowercase letters, numbers, and hyphens.
3. Create the organization.New organizations are always private; there is no visibility selector in onboarding.
4. Open the workspace.Mozaic creates an isolated organization session and redirects to its Home view.

Add the first project

You need a project for Work, repositories, reviews, pipelines, project Knowledge, Packages, and project integrations. You do not need one for organization communication and coordination.

The Projects directory lists loaded projects alphabetically by display name, ignoring ASCII letter case. Choose Load more projects when available to continue the same ordered directory.

1. Name the project.Choose the human-readable name shown throughout the workspace.
2. Choose a project key.Use 2–10 letters (A–Z), such as SDK. Mozaic stores the key in uppercase and uses it as the prefix for work-item references such as SDK-123. It must be unique within the organization and cannot be changed after creation.
3. Confirm the slug.This becomes the project portion of its URL.
4. Write the summary.Use the rich editor to explain the purpose. Summary edits later retain immutable revision history.
5. Create the project.It starts private. Continue to Code to create a repository, Work to create a board, or Knowledge to create pages.

The creation form stays inside your organization, with its navigation available. Choose Cancel to return without creating a project; if you have entered anything, confirm whether to discard the unsaved changes or keep editing.

Choose a project appearance

Open Project › Settings › General › Appearance with the project's Manage projects permission. Choose a card background and accent from the fixed presets. The live preview shows your draft; the Projects directory changes only after Save appearance. Complete fresh identity verification when requested.

Choose Choose or upload logo for the image gallery. Only processed, ready images can be selected. Uploads inherit this project's audience; reusing an image from another audience requires the gallery's explicit sharing confirmation. The logo stays pinned to that exact image version when the asset is replaced. If its bytes become unavailable, the project key supplies initials.

Remove logo clears the selection without retiring the asset. Reset to defaults selects the neutral background, violet accent, and initials in the draft and still requires Save. Cancel restores saved choices. If another edit changed the project version, your draft is preserved; Reload latest and discard draft fetches current values before you continue. Appearance does not publish the project or other media.

Use Overview as the project map

Project › Overview renders the rich project summary, counts the loaded open work, pipeline runs, package versions, and Knowledge pages, and links to recent delivery and work. Its audit-aware activity timeline contains only events you are authorized to see; No visible activity has been recorded is a valid empty state, not evidence that private activity does not exist.

Accept an invitation

For a personal account, open the one-time invitation URL while signed in with the invited verified email address. For company sign-in, use the configured provider and complete the separate recipient proof in the original browser. Complete strong authentication if requested, then choose Accept invitation. Acceptance validates the email, expiry, exact role version, optional team, and current organization policy together.

Recover access or change appearance

Forgotten password

From Sign in, choose Recover account, submit the email, then use the token from the message to set a new password of at least 15 characters. The request response does not reveal whether an account exists.

Recovery-code security check

From Account › Security, enter an unused recovery code. Regenerating codes immediately invalidates every previous code and shows the replacement set once. Choose Download recovery codes while that set is visible to save the replacement file; keep it private and replace your old copy.

If every enrolled authenticator is unusable and you have no recovery code, contact the installation operator for account recovery. After the operator verifies your identity and resets MFA, all browser sessions and old methods are invalidated. Sign in with your existing password, enroll a new authenticator in Account › Security, and save the newly displayed recovery codes. Privileged workflows require fresh enrollment and verification.

Appearance

Choose Light or Dark. This preference is stored in the current browser.

Limits and common failures

• Creating an account does not automatically create an organization.
• Creating an organization does not automatically create a project.
• Organization, project, and repository creation never publish the resource.
• Recovery codes and other one-time secrets cannot be displayed again after dismissal.