Applications can offer "sign in with Crux ID". When one does, you are sent to id.cruxinteractive.com to approve it, and Crux tells the app who you are without ever giving it your password.
What the approval screen shows
It names the application requesting access and lists the permissions it wants. Read that list — it is the whole point of the screen, and it is the only moment you get to decide.
What the permissions mean
- Profile — your basic account details, such as your username.
- Email — the email address on your account.
- Crux Cloud — access to your stored files.
- Crux Spaces — access to your Spaces.
- CruxAI — access to CruxAI features on your behalf, which can be requested in finer detail: chat, image generation, memory, and web search.
Deciding whether to approve
- Does the request match the app? A tool that only needs to know who you are should not be asking for your Cloud files.
- Did you start this? If an authorization screen appears that you did not initiate, cancel it. Legitimate sign-in always begins with you selecting something.
- Do you know who made the app? Approving grants ongoing access, not one-time access.
You can cancel at any point on that screen. Nothing is shared unless you approve.
Your password is never shared
Applications never receive your password, and never see your two-factor codes. Any app asking you to type your Crux password into its own screen is not using Crux sign-in — do not enter it.
Reviewing access later
Check Connections and Active Sessions in the account portal to see what is connected to your account. Anything you no longer use or do not recognize should be removed, and it is worth a look every few months.
If you approved something you should not have
- Remove the connection in the account portal.
- Select Sign out all others.
- Change your password.
- Turn on two-factor authentication if it is not already on.