# Create an account

> Sign up at dash.openwaf.dev with a one-time email code, Google or GitHub, and create your organization.

OpenWAF has no passwords. You sign in with a one-time code sent by email, or with your Google or GitHub account. Signing
up creates your user and your **organization**, the account that owns your domains, members and API tokens.

## Sign up

1. Open [dash.openwaf.dev/signup](https://dash.openwaf.dev/signup).
2. Choose **Continue with Google**, **Continue with GitHub**, or enter your work email and select **Email me a code**.
   - Google and GitHub sign-in only work with an account whose email the provider has verified.
   - Disposable email addresses are not accepted.
3. If you chose email, enter the 6-digit code from the message and select **Continue**. The code is valid for 15
   minutes and allows 5 attempts. The email also contains a link: it opens a page that shows the address you are signing
   in as, and you confirm with **Sign in as …**.
4. On **Tell us about you and your agency**, enter your name and the name of your agency or company.
5. Accept the [Terms of service](https://openwaf.dev/legal/terms/), the
   [Acceptable use policy](https://openwaf.dev/legal/acceptable-use/) and the
   [Data processing agreement](https://openwaf.dev/legal/dpa/), then select **Create organization**.


You become the **owner** of the new organization. The dashboard then opens the wizard
[Let's protect your first site](https://developers.openwaf.dev/fundamentals/add-site/).

> **Note**
>
> We may review new organizations before activating them. If the dashboard shows
> **Your account is waiting for approval**, you will receive an email as soon as the organization is ready.


## What your organization gets

- A fixed pair of **nameservers** under `ns.openwaf.dev`, for example `faros.ns.openwaf.dev` and
  `polaris.ns.openwaf.dev`. The pair is chosen when the organization is created and never changes: every domain you
  delegate to OpenWAF uses the same two names. See [Delegate a zone](https://developers.openwaf.dev/dns/delegate-a-zone/).
- Room for up to 100 domains by default during early access. See [Limits and plans](https://developers.openwaf.dev/fundamentals/limits/).
- Members, clients, API tokens and an audit log of every change.

## Sessions

A dashboard session lasts up to 30 days and ends after 7 days without activity. **Sign out** ends the current session;
**Account › Sign out everywhere** ends all your sessions on every device. API tokens are not affected: revoke them in
**API tokens** if needed.

Sign-in codes are rate limited: at most 5 codes per hour for one email address and 20 per hour from one IP address.

## Delete your account

**Account › Delete account** ends your sessions and removes your memberships and API tokens. It also deletes any
organization where you are the only owner and that has no domains left. While you are the only owner of an
organization that still has domains, deletion is refused: delete those domains or make someone else owner first.

## Sign in on a white-label dashboard

If your agency gives you a dashboard on its own domain (for example `dash.youragency.com`), sign in there with your
email code. Google and GitHub sign-in are only offered on `dash.openwaf.dev`. See
[White-label dashboard](https://developers.openwaf.dev/fundamentals/white-label/).

## Next steps

- [Add your first site](https://developers.openwaf.dev/fundamentals/add-site/): Add a domain and put its first site behind the WAF.
- [Team members](https://developers.openwaf.dev/fundamentals/team-members/): Invite the people who work with you.
- [API tokens](https://developers.openwaf.dev/fundamentals/api-tokens/): Automate with the API, the CLI or an AI assistant.