Login Settings

Render integrates with multiple login providers and helps you enforce secure login requirements for your workspace.

Supported login methods

• Any of the following account providers:
  • Google
  • GitHub
  • GitLab
  • Bitbucket
• Email and password
• SAML SSO (requires a Scale or Enterprise plan)

Managing login methods

Go to the Account Security section of your Account Settings page:

Here, you can:

• Update your password
• Add or remove connected login methods
• Add or remove connected Git deployment credentials
  • Render uses these credentials to access your repositories for deploys.
• Toggle two-factor authentication (2FA)

Rules for account connections

• If you connect a Git provider for both login and deployment, you must use the same account for both.
• You can use a Git provider for deployment without using it for login (or vice versa).
• Multiple Render accounts can't use the same provider account to log in.
• Multiple Render accounts can use the same provider account for deployment.
• You can't disconnect your Google account if you belong to a workspace that enforces Google-account-based login.
  • First, leave any such workspaces.

Enforcing secure login

Your workspace can require its members to use any combination of the following login practices:

• Two-factor authentication (2FA)
• Google account login

Only workspace admins can configure these enforcements.

With a Scale or Enterprise plan, you can also enforce secure login via SAML SSO.

Two-factor authentication

Enforce two-factor authentication (2FA) from your Workspace Settings page:

If you enforce 2FA, your team members can't access the workspace's resources or settings until they enable 2FA for their Render account.

Team members with SSH or API keys can't use these keys to access workspace resources until they enable 2FA.

Google account login

Enforce Google-account-based login from your Workspace Settings page:

If you enable this feature:

• Team members can't access the workspace's resources or settings if they log in using any method besides their Google account (such as username and password).
• Team members can't change their Render account's associated email address.
• Team members must sign in with the Google account that matches the invited email address.
  • For example, a workspace invitation for person@example.com must be accepted by signing in with that specific Google account, not a personal Gmail address.

API keys must be created while signed in via Google account to access resources of a workspace that enables this feature. API keys created before May 1, 2024 are not subject to this restriction.