Your sign-in is the one door into everything your business says to its customers. This is the short version of how that door works.
The login page
/app/login. Your email address, your password, Sign in.
Two other things may be on that page, depending on how your installation is set up:
- Continue with Google. Shown when the installation allows Google as a login method and has a Google client id configured. It signs you in as the Lynomia Chat user whose email address matches your Google account. While self-service sign-up is off — the default, see below — it will not create one: if no user holds that address you are returned to the login page with no account found.
- Forgot password. Shown unless the installation has locked profile editing.
You sign in as a person, not as a business. One sign-in gets you to every account you have been added to, and the account switcher inside the dashboard moves you between them. There is no separate password per business.
If your email address has not been confirmed yet, signing in does not fail with a wrong-password error — it takes you to the Verify your email page instead.
Creating an account yourself
Self-service sign-up is switched off by default. The page at /app/auth/signup exists, but while sign-up is disabled it redirects straight to the login page, the Create a new account link is not shown on the login page, and the API that would create the account refuses as if it were not there.
What controls it is an installation setting, ENABLE_ACCOUNT_SIGNUP, set by whoever runs your Lynomia Chat
installation in Super Admin → Settings. It is not in your account settings and no account administrator can
change it. On most installations the way in is an invitation — see invite your team.
Where sign-up is enabled, it asks for two things: an email address and a password. Then:
- Your business name and your own name are taken from the email address, not asked for.
fatima@almanar.comproduces a user called Fatima in an account called Almanar. Fix both afterwards — your name in your profile, the business name in account settings. - You are not signed in yet. No session is created. Lynomia Chat sends a confirmation email and shows you the Verify your email page.
- Open the link in that email. Only then can you sign in.
- The first person in a new account is its administrator.
The address has to be a real, non-disposable business address, and it has to be new to the installation — an address already in use is refused rather than joined to anything.
Resending the confirmation email
The Verify your email page has a Resend button, and it is also where a sign-in attempt by an unconfirmed user lands, so you can get back to it without the original email. Resending is limited to five attempts per hour for one address.
A confirmation email that never arrives is almost always a mail problem at the installation, not at your end.
The password rules
These are enforced on the server, so they apply to sign-up, to a password reset, and to changing your password later.
| Requirement | Detail |
|---|---|
| Length | at least 6 characters, at most 128 |
| Uppercase | at least one A–Z |
| Lowercase | at least one a–z |
| Digit | at least one 0–9 |
| Special character | at least one punctuation or symbol character |
Any of the ordinary keyboard symbols counts as the special character — ! @ # $ % ^ & * ( ) _ + - = [ ] { }
and the usual punctuation.
The sign-up form shows the five rules beside the password box and ticks them off as you type. Six characters is the floor, not a recommendation; a passphrase is better than a six-character password that satisfies the checklist.
Forgetting your password
Forgot password on the login page, or /app/auth/reset/password. Type your email address and send it.
- The reply is the same whether or not the address exists. A email with instructions will be sent to your email if it exists. That is deliberate — the page will not tell a stranger which addresses are real — so an unexpected silence means you may have typed the wrong address.
- The link in the email is valid for six hours. After that, ask for a new one.
- Completing a reset also confirms an unconfirmed account, so a password reset is a way out of a lost confirmation email.
- Resets are limited to five per address per hour, and five per IP address per thirty minutes.
An administrator can trigger a reset email for a colleague from that person's page, but cannot read or choose anybody's password. See invite your team.
To change a password you still know, use Profile Settings → Change password: it asks for your current password first, and the new one must satisfy the table above.
Two-factor authentication
Settings → Profile Settings → Two-Factor Authentication.
With it on, your password alone is not enough: signing in then asks for a six-digit code from an authenticator app on your phone. Lynomia Chat uses TOTP, which is what Google Authenticator, Authy and the rest produce. Your profile and security covers switching it on, step by step.
Backup codes
When two-factor is activated you are given ten backup codes, each eight characters long. They are the way back in when the phone is lost, broken or replaced.
- Each code works once. Using one consumes it; the other nine still work.
- Copy puts all ten on your clipboard; Download saves them as a text file named after your installation.
- Store them somewhere that is not the phone running the authenticator app. A password manager is the right place.
- When three or fewer remain, a banner appears in the dashboard. At zero it turns into a warning you should act on the same day: a lost phone with no codes left means an operator has to intervene.
Regenerating them
Two-Factor Authentication → Regenerate backup codes, with a current six-digit code from your authenticator app. You need the app to do this, which is the point — a stolen backup code cannot be used to mint ten more.
Regenerating replaces all ten. Any code you had written down before stops working, used or not, so destroy the old copy.
Signing in with it on
Password first, then the second step:
| What you enter | |
|---|---|
| Authenticator app | the six digits; it submits itself as soon as the sixth is typed |
| Backup code | the eight-character code, chosen with the use a backup code option |
Finish the second step within five minutes. The half-finished sign-in expires after that and you start again from the password. The second step is also rate-limited — ten attempts a minute, counted both per address and per half-finished sign-in.
Switching it off
Two-Factor Authentication → Disable, and it asks for your account password and a current code — six digits from the app, or an unused backup code. Both, not either. Disabling clears the pairing and all ten backup codes, so switching it on again starts from a fresh QR code and a fresh set of codes.
Signed in on too many devices
A user may hold up to 25 sessions at once. Sign in past that from a browser and Lynomia Chat does not refuse you — it lists the existing sessions and asks which to end, or offers to end all of them. The same list lives in Profile Settings → Active sessions, where you can end a session you no longer recognise without waiting to be asked.
Limits
- Two-factor is per person, not per account. There is no setting that requires it of everybody, and switching it on protects you alone. Encourage it; you cannot enforce it.
- Two-factor needs the installation to support it. It depends on encryption keys being configured where Lynomia Chat is deployed. Without them the Two-Factor Authentication page sends you back to Profile Settings the moment you open it, and the API answers that the feature is unavailable. That is a deployment matter, not something you can fix from the dashboard.
- No administrator in your account can reset a colleague's two-factor. Password resets, yes; two-factor, no. A colleague locked out with no backup codes left needs whoever runs the installation.
- Repeated failed sign-ins are throttled, not locked. Five attempts from one IP address in five minutes, and ten for one email address in fifteen minutes, then requests are refused for a while. Nothing is permanently locked and no email is sent about it, so an unexplained refusal that clears by itself is usually this.
- Changing your email address signs you out, because it is the credential you sign in with.
- Google sign-in is a sign-in, not a second password. Removing your Google access does not remove your Lynomia Chat user, and a user created through Google still has a Lynomia Chat password it can reset.
Related
- Your profile and security
- Roles and permissions
- Invite your team
- Set up your account
- Open a ticket with Lynomia
If it does not work
"Invalid login credentials" and I am sure the password is right. Check the email address for a typo first. Then consider whether you are hitting the sign-in throttle — wait five minutes and try once, rather than ten times.
I get sent to "Verify your email" instead of the dashboard. The address is not confirmed. Use Resend on that page, or ask for a password reset: completing one confirms the account.
There is no "Create a new account" link. Self-service sign-up is switched off on this installation. Ask an administrator of the business to invite you.
"Continue with Google" is not on the login page. Google login is not enabled on this installation, or no Google client id is configured. Use your email address and password.
Google says I signed in, Lynomia Chat says no account found. No Lynomia Chat user has that email address, and sign-up is disabled, so nothing was created. You need an invitation to the right address.
Two-Factor Authentication bounces me back to Profile Settings. The installation does not have two-factor available. Nothing you do in your profile will change that.
My authenticator code is always rejected. The six digits are time-based, so a phone whose clock has drifted produces codes that are wrong everywhere. Let the phone set its time automatically, then try again, and use a backup code in the meantime.
I used my last backup code. Regenerate immediately, while you still have the authenticator app in your hand. The next lost phone has nothing left to fall back on.