One login for every app you own
July 28, 2026
Software collects logins the way a junk drawer collects keys. You start with one tool, add a scheduling app, a client portal, a mobile app for the crew, and an internal dashboard — and now every new hire needs five accounts, every departure needs five revocations, and every customer who forgets a password has to guess which of your five systems they forgot it in.
The cost is support, not security theatre
Separate logins per app feel harmless until you count what they generate. Password resets are the single most common support request most small businesses get. Multiply that by the number of front doors you’ve built, add the people who create a second account because they assumed the first didn’t work, and you have a steady tax paid in your own time.
The security version of the same problem is worse and quieter: when someone leaves, access lingers wherever nobody remembered to look. Offboarding that depends on memory isn’t offboarding.
What consolidating actually looks like
I moved five products behind a single identity service on its own subdomain, with a sign-in screen carrying the same wordmark, colours, and typography as the products themselves — so it doesn’t look like being handed off to a stranger halfway through logging in. Each application asks that one service who you are rather than keeping its own copy of the answer.
- One account, one password, one reset flow — across web and mobile.
- Email addresses are verified once, centrally, instead of five inconsistent times.
- Sign-in, verification, and password-reset emails all come from your own domain and look like your brand.
- Removing someone removes them everywhere, in one action.
The parts worth knowing before you commit
Two things surprised me and are worth passing on. First, hosting matters more than expected — the first platform I tried simply could not run the protocol the identity service speaks, so the deployment target was decided by a networking detail rather than by price. Second, account linking needs to be tested deliberately, not assumed: one human signing in two different ways should end up as one person with two credentials, not as two accounts that slowly diverge.
The whole configuration lives in version control rather than in a dashboard someone clicked through once. That’s not fastidiousness — it’s the difference between rebuilding your login system from a file and rebuilding it from memory.
The takeaway
Every additional login is another password reset, another forgotten revocation, and another chance to lose a customer at the door. One identity for every app you run pays for itself in support time before it pays for itself in security.
Capabilities this touches