Whoever administers it can invite people and choose what each of them may do. Creating a group needs to be done by an owner, because a group is what can carry permission to order machines.

Leaving the password empty is the usual thing: the account cannot be signed in to with one until somebody sets it, so the person arrives through a provider or through a reset link sent to a confirmed address.

Profile

Change your password

Every other browser signed in as you is signed out when this changes. This one stays.

Ways to sign in

You can have more than one. Kittiwake never matches a provider account to this one by email address — several providers will hand out an address they have not verified, so linking is something you do here while signed in.

A six-digit code from an authenticator app, asked for after your password. Worth having if this account can spend money — ordering a machine is a thing a borrowed password should not be able to do.

A token acts as you — the same groups, the same permissions, checked on every request — and can be revoked on its own. Use one instead of sharing the deployment-wide token, which is every permission there is.