Early access

While a Diffinery instance is invite-only (the default), people without an invitation can ask for one at /early-access on that instance. The sign-in page and the sign-up address lead there. A request never grants access by itself: a site administrator reads it and decides whether to send an invitation.

On diffinery.com, the project's own instance, this is how to try Diffinery before you deploy your own: request early access there.

The form is only there while sign-up is closed. On an instance with open sign-up (SIGNUP=open), /early-access leads to the sign-up page instead.

#Request early access

1. Open /early-access. If you're already signed in, you go to your dashboard instead.

2. Fill in the form. Only Work email is required:

   Field	Limit	What it's for
   Work email	a valid address, up to 254 characters	Where the confirmation link and, later, the invitation go
   Name	up to 100 characters	How the site administrators address you
   Company or team	up to 120 characters	Who you'd use Diffinery with
   What would you use Diffinery for?	up to 1,000 characters, plain text	What you'd move or build, so the site administrators can prioritize
   Where do you host your code today?	one of GitHub, GitLab, Bitbucket, Azure DevOps, Self-hosted, Somewhere else, Nowhere yet	Helps plan your move

3. Complete the "are you a person" check if one shows, and click Request early access.

4. You see Check your inbox. Open the email titled "Confirm your early access request" and click Confirm my request, then press Confirm my request on the page that opens. The link works once, for 48 hours; asking again sends a new link, and only the newest one works.

5. You see You're on the list. Your request now waits for a site administrator.

When a site administrator invites you, you get the usual invitation email ("invited you to Diffinery"). Its link lets you pick a username and create a passkey; see How sign-up works. Nobody emails you if your request is declined.

#What the email says

The form always shows Check your inbox, whatever the address. What arrives depends on the address:

So only the person who reads that inbox learns whether the address has an account or asked before; the form itself never tells anyone. These emails never contain anything typed into the form.

#Removing your request

You can delete your request yourself at any time, whatever its state:

1. Open /early-access/remove (the form's privacy note links to it).
2. Enter the address of the request, complete the check if one shows, and click Email me a removal link.
3. Open the email titled "Remove your early access request" and click Remove my request, then press Remove my request on the page that opens. You see Your request is removed.

The link works once, for 24 hours. The page answers Check your inbox whether or not the address has a request, and only an address with one gets an email, so nobody can remove or look up someone else's request. Removal links count towards the same daily limits as requests. A site administrator can also delete a request for you.

Unconfirmed requests are deleted automatically 7 days after they were last sent.

#What is stored

Your IP address and the address you typed are never stored in the clear for the limits, and nothing you type is written to logs. Only site administrators can read requests. In the data model, these are the early_access and early_access_attempts tables.

#How the form is protected

#For site administrators

Settings → Early access (/settings/admin/early-access) is in the Site administration group. The sidebar shows how many confirmed requests are waiting, People and invitations has a reminder while any are, and each site administrator gets one in-app notification, "New early access requests are waiting for you", which stays until it is read however many requests arrive. There are no per-request emails. Anyone who isn't a site administrator gets 404.

The tabs filter by state, with counts:

The search box finds requests whose address, name, company or use contains what you type. Each request shows its name and address, company, where they host code, when they asked, the start of what they'd use Diffinery for, and an amber has an account badge when an active account already uses the address. Click a name to see everything, including the full text and its reference.

• Invite asks you to confirm, then sends the address the instance's invitation email, exactly like Invite someone to this instance on People and invitations: it works once for 14 days. The request becomes Invited. If the address already has a pending instance invitation, that one is kept and no second email is sent. An address that already has an account has no Invite button. You can invite an unconfirmed request too: the invitation itself only works for someone who reads that inbox.
• Decline marks the request Declined. Nobody is emailed. Put back on a declined request returns it to Confirmed (or Unconfirmed, if it never was).
• Delete request, on a request's page, removes it for good, for someone who asks for their data to be removed. An invitation already sent stays; revoke it on People and invitations.

Every decision is in the audit log: early_access.invite (with invite.create when a new invitation is sent), early_access.decline, early_access.restore and early_access.delete (also when someone removes their own request), and early_access.confirm when an address confirms. Entries name the request by its id; none holds what the request said, and early_access.delete doesn't hold the address.

#From the API

With a site administrator's token (read to list, admin to change):

# Confirmed requests waiting for a decision
curl -H "Authorization: Bearer $DIFFINERY_TOKEN" \
  "https://diffinery.com/api/v3/diffinery/admin/early-access?state=confirmed"

# Invite one
curl -X POST -H "Authorization: Bearer $DIFFINERY_TOKEN" \
  https://diffinery.com/api/v3/diffinery/admin/early-access/<id>/invite

Each request has id, state, email, name, company, use_case, hosting, confirmed_at, invite_id, decided_by, decided_at, created_at, updated_at and html_url. Everyone else gets 404. See the API reference for every field.

#Troubleshooting