Documentation index: llms.txt. This page is also available as markdown: append .md to this URL or send Accept: text/markdown.
Authentication Upgrade
Coalesce Transform is moving to a modern identity platform. This page covers what's changing, whether you need to do anything, and how to get help if you get stuck signing in.
This upgrade hasn't rolled out yet, so there's nothing to do today. Keep signing in as you do now. Coalesce lets you know before the change takes effect, so you don't need to watch this page for the switch.
What's Changing
The upgrade replaces the identity system behind Transform sign-in. Two things come out of it.
Stronger account security. Transform moves onto dedicated identity infrastructure, which gives your account better protection and gives Coalesce a foundation for improved security controls going forward.
One set of credentials across Coalesce. Catalog and Quality already run on this platform. Bringing Transform across means the same credentials work for all three products, so there's one password to manage instead of a separate one for each. You may still be prompted to sign in when you open another Coalesce product, but you'll use the same credentials every time.
The rollout happens in the coming weeks, region by region, and covers organizations that sign in at the standard Coalesce sign-in page. Everyone in your region who signs in with an email and password moves at the same time, so your whole team sees the change together rather than one person at a time. Coalesce lets you know before the upgrade takes effect for your organization, and an announcement appears in Transform.
Organizations that sign in through their own subdomain aren't part of that regional rollout. Those migrations are coordinated directly with Coalesce Support, so your timing and your steps come from your support contact rather than from the schedule above.
When the upgrade takes effect for your organization, your current session ends and you're signed out of Transform. Signing back in is how you'll notice the change, so it's worth setting your new password once the upgrade reaches you rather than waiting to be interrupted mid-task. Work you've already saved isn't affected.
Who Needs to Take Action
What you need to do depends on how your organization reaches Transform and on how you sign in today. Find your sign-in method in this table.
Check the address you use to sign in to Transform. If it includes your organization's own name, like https://yoursubdomain.app.coalescesoftware.io/, your organization uses a subdomain and the password reset on this page doesn't apply to you yet. Coalesce Support coordinates your organization's migration directly and confirms the timing and the steps with you.
If you sign in at the standard Coalesce sign-in page, without your organization's name in the address, the regional rollout described on this page applies to you.
| How you sign in | What you need to do |
|---|---|
| Email and password at the standard Coalesce sign-in page | Reset your password once the upgrade is live, using Reset password on the sign-in page |
| Email and password through your organization's subdomain | Nothing right now. Coalesce Support coordinates your organization's migration and confirms the timing with you |
| Single sign-on (Okta, Microsoft Entra ID, Google Workspace, SAML) | Nothing right now. Your organization's single sign-on moves separately at a later date, and Coalesce coordinates that change directly with your IT team |
| Service accounts using email and password | Reset the password like any other account, then update the stored credential wherever your team keeps it. See Service Accounts and Other Shared Sign-Ins |
| Transform API Tokens | Nothing. Tokens aren't affected and don't need rotating |
Why a Password Reset Is Needed
Passwords are never stored in a readable form. They're stored as one-way cryptographic hashes, which is exactly what makes them secure. The previous system and the new one use different hashing methods, and by design a hash can't be converted from one to the other. Existing passwords can't carry across, so everyone who signs in with an email and password sets a new one when their organization moves.
A password reset done before the upgrade goes live applies to the old system and won't carry over. Wait for the notification that the upgrade is live.
How to Reset Your Password
Once the upgrade is live, resetting your password takes about a minute. This is a one-time step.
The reset uses an email challenge to confirm it's you. Coalesce sends a link to the address on your Coalesce account, and selecting that link is what verifies the request came from you. You can't complete the reset without access to that inbox, so make sure you can receive mail there before you start.
- Go to your Coalesce Transform sign-in page.
- Enter the email address on your Coalesce account and select Continue.
- On the password screen, select Reset password.
- Confirm your email address and select Continue. A Check Your Email screen confirms the request.
- Open the email from
support@coalesce.ioand select the reset link. - Choose a new password and sign in.
Reset links expire. If yours has expired, repeat these steps to get a new one.
Service Accounts and Other Shared Sign-Ins
A service account that signs in with an email and password resets its password the same way a person does, and the same one-time reset is required. The difference is what happens afterward: the new password has to be written back to wherever your team stores it, such as a secret manager or password vault. Until you do that, anyone relying on the stored copy is locked out.
- Make sure someone on your team can open mail at the address on the service account, usually a distribution list. If nobody can, fix that before the upgrade reaches you.
- Reset the password at first sign-in after the upgrade.
- Replace the stored copy of the password in your secret manager or vault immediately, so the rest of the team keeps access.
Transform API Tokens issued to a service account keep working throughout, so Scheduled Jobs and deployments don't pause while you do this. See Service Accounts in Coalesce for setup guidance.
Before the Upgrade Reaches You
Because the reset is verified by an email challenge, both of these are worth doing ahead of time.
Allowlist the reset email sender. The most common problem people hit is that the reset email never arrives, because their organization's mail filtering blocks or quarantines it. If you're an IT administrator, allowlist support@coalesce.io ahead of the rollout.
Confirm your email address is current. Check that the address on your Coalesce account is one you can still access. If you can't open mail at that address, you won't be able to complete the reset. Ask your organization administrator to sort it out before the rollout reaches you.
What Stays the Same
The only thing changing is how you sign in. Everything you build and everything that runs on a schedule is untouched.
- Transform API Tokens aren't affected. Scheduled Jobs, CI pipelines, and integrations keep running, and no rotation is needed.
- Your Projects, Nodes, and Workspaces are unchanged.
- Your role and access stay the same.
If anything about your access looks wrong after you sign in, contact Coalesce Support.
Rotating Transform API Tokens
Passwords and Transform API Tokens are managed by two separate systems, so changing one doesn't affect the other. Resetting your password during the upgrade doesn't rotate your tokens, and it won't in the future either.
If you rotate tokens as part of a security policy, rotation is now something you ask for directly rather than a side effect of a password change. Call the token revocation endpoint to invalidate a user's existing tokens, then generate a replacement token as usual from the Deploy tab.
POST /api/v1/users/{userId}/revoke-refresh-tokens
This endpoint is available in Coalesce 7.40 and later. See Getting an Access Token for how tokens are generated.
Password reset links only ever come from support@coalesce.io, and they only ever point to a Coalesce domain. If an email claiming to be a Coalesce password reset looks off, don't select the link. Forward it to Coalesce Support instead.
Troubleshooting
Most sign-in questions after the upgrade fall into one of the following situations.
Transform Signed You Out Without Warning
This is expected on the day the upgrade reaches your organization. Existing sessions end so that everyone signs in through the new identity platform. Sign in again, resetting your password first if you use an email and password.
The Sign-In Page Looks Different
This is expected. The new sign-in page is served by the upgraded identity provider, so it's the same URL with a new design. Sign-in is also split across two screens now: you enter your email address first, select Continue, and enter your password on the next screen.
A Prompt Asks Which Organization to Sign In To
This is also expected if you belong to more than one Coalesce organization. Choose the organization you're working in.
On the new platform you can hold membership in several organizations at once, and the sign-in page lists the ones you belong to. Switching is a matter of signing in and picking a different organization from that list, rather than having your account moved from one organization to another. Organizations that haven't moved to the new platform yet aren't in the list and are still reached the way they are today.
The Reset Email Didn't Arrive
Check your spam folder and your mail quarantine, and confirm you entered the exact email address on your Coalesce account. Select Resend email on the Check Your Email screen to send it again. If your organization filters external mail, ask your IT team whether support@coalesce.io is allowed. If nothing arrives after 15 minutes, contact Coalesce Support.
Because the reset is verified by email, there's no way to finish it without receiving that message. If the address on your account is one you can no longer open, requesting more links won't help. See the next section instead.
You Can No Longer Open the Email Address on Your Account
Your organization administrator can sort this out for you, and they can act on it immediately. They can create a new user for you with an address you can reach, and they can work with Coalesce Support to authorize a change to the address on an existing account. Work isn't transferred between accounts, so a new user starts fresh. See Changing Your Login Email.
Access to your email is what proves an account belongs to you, so a change of address is confirmed through your organization. That's what keeps someone else from claiming your account, and it's why your administrator is the quickest way through.
You can avoid this situation entirely. Check now that the address on your Coalesce account is one you can still open, and update it with your administrator before the upgrade reaches you.
The Reset Link Expired
Request a new link by selecting Reset password again on the sign-in page.
Scheduled Jobs and API Integrations
Automation keeps running. Transform API Tokens aren't part of this upgrade and don't need to be rotated. If you want to rotate them anyway, see Rotating Transform API Tokens.
If a Scheduled Job or integration signs in with a service account's email and password rather than a token, that account needs the same one-time reset. See Service Accounts and Other Shared Sign-Ins.
What Changes for Single Sign-On Administrators
Your organization's single sign-on isn't part of this rollout, so nothing changes for your users yet. They keep signing in as they do today.
Separately, single sign-on is moving to a model where you configure one connection that covers Transform, Catalog, and Quality together, rather than setting up each product on its own. Moving to that model is required to use the shared credentials across all three, and existing single sign-on configurations are retired after a transition period. This is a coordinated, scheduled change, and Coalesce reaches out to plan it with you, including anything you need to update on your side such as allowlisted sign-in URLs.