Your sign-in is the one door into everything your business says to its customers. This is the short version of
how that door works.

## The login page

**/app/login.** Your email address, your password, **Sign in**.

Two other things may be on that page, depending on how your installation is set up:

- **Continue with Google.** Shown when the installation allows Google as a login method and has a Google client
  id configured. It signs you in as the Lynomia Chat user whose email address matches your Google account. While
  self-service sign-up is off — the default, see below — it will not create one: if no user holds that address
  you are returned to the login page with *no account found*.
- **Forgot password.** Shown unless the installation has locked profile editing.

**You sign in as a person, not as a business.** One sign-in gets you to every account you have been added to,
and the account switcher inside the dashboard moves you between them. There is no separate password per
business.

If your email address has not been confirmed yet, signing in does not fail with a wrong-password error — it
takes you to the **Verify your email** page instead.

## Creating an account yourself

**Self-service sign-up is switched off by default.** The page at **/app/auth/signup** exists, but while sign-up
is disabled it redirects straight to the login page, the **Create a new account** link is not shown on the login
page, and the API that would create the account refuses as if it were not there.

What controls it is an installation setting, `ENABLE_ACCOUNT_SIGNUP`, set by whoever runs your Lynomia Chat
installation in Super Admin → Settings. **It is not in your account settings and no account administrator can
change it.** On most installations the way in is an invitation — see [invite your team](invite-your-team).

Where sign-up is enabled, it asks for two things: an email address and a password. Then:

1. **Your business name and your own name are taken from the email address**, not asked for. `fatima@almanar.com`
   produces a user called *Fatima* in an account called *Almanar*. Fix both afterwards — your name in your
   profile, the business name in [account settings](set-up-your-account).
2. **You are not signed in yet.** No session is created. Lynomia Chat sends a confirmation email and shows you
   the **Verify your email** page.
3. **Open the link in that email.** Only then can you sign in.
4. The first person in a new account is its **administrator**.

The address has to be a real, non-disposable business address, and it has to be new to the installation — an
address already in use is refused rather than joined to anything.

### Resending the confirmation email

The **Verify your email** page has a **Resend** button, and it is also where a sign-in attempt by an
unconfirmed user lands, so you can get back to it without the original email. Resending is limited to **five
attempts per hour** for one address.

A confirmation email that never arrives is almost always a mail problem at the installation, not at your end.

## The password rules

These are enforced on the server, so they apply to sign-up, to a password reset, and to changing your password
later.

| Requirement | Detail |
|---|---|
| Length | at least **6** characters, at most **128** |
| Uppercase | at least **one** A–Z |
| Lowercase | at least **one** a–z |
| Digit | at least **one** 0–9 |
| Special character | at least **one** punctuation or symbol character |

Any of the ordinary keyboard symbols counts as the special character — `! @ # $ % ^ & * ( ) _ + - = [ ] { }`
and the usual punctuation.

The sign-up form shows the five rules beside the password box and ticks them off as you type. Six characters is
the floor, not a recommendation; a passphrase is better than a six-character password that satisfies the
checklist.

## Forgetting your password

**Forgot password** on the login page, or **/app/auth/reset/password**. Type your email address and send it.

- **The reply is the same whether or not the address exists.** *A email with instructions will be sent to your
  email if it exists.* That is deliberate — the page will not tell a stranger which addresses are real — so an
  unexpected silence means you may have typed the wrong address.
- **The link in the email is valid for six hours.** After that, ask for a new one.
- **Completing a reset also confirms an unconfirmed account**, so a password reset is a way out of a lost
  confirmation email.
- Resets are limited to **five per address per hour**, and five per IP address per thirty minutes.

An administrator can trigger a reset email for a colleague from that person's page, but cannot read or choose
anybody's password. See [invite your team](invite-your-team).

To change a password you still know, use **Profile Settings → Change password**: it asks for your current
password first, and the new one must satisfy the table above.

## Two-factor authentication

**Settings → Profile Settings → Two-Factor Authentication.**

With it on, your password alone is not enough: signing in then asks for a six-digit code from an authenticator
app on your phone. Lynomia Chat uses TOTP, which is what Google Authenticator, Authy and the rest produce.
[Your profile and security](your-profile-and-security) covers switching it on, step by step.

### Backup codes

When two-factor is activated you are given **ten backup codes**, each eight characters long. They are the way
back in when the phone is lost, broken or replaced.

- **Each code works once.** Using one consumes it; the other nine still work.
- **Copy** puts all ten on your clipboard; **Download** saves them as a text file named after your installation.
- Store them somewhere that is not the phone running the authenticator app. A password manager is the right
  place.
- When **three or fewer** remain, a banner appears in the dashboard. At zero it turns into a warning you should
  act on the same day: a lost phone with no codes left means an operator has to intervene.

### Regenerating them

**Two-Factor Authentication → Regenerate backup codes**, with a **current six-digit code from your
authenticator app**. You need the app to do this, which is the point — a stolen backup code cannot be used to
mint ten more.

Regenerating **replaces all ten**. Any code you had written down before stops working, used or not, so destroy
the old copy.

### Signing in with it on

Password first, then the second step:

| | What you enter |
|---|---|
| **Authenticator app** | the six digits; it submits itself as soon as the sixth is typed |
| **Backup code** | the eight-character code, chosen with the *use a backup code* option |

**Finish the second step within five minutes.** The half-finished sign-in expires after that and you start
again from the password. The second step is also rate-limited — ten attempts a minute, counted both per address
and per half-finished sign-in.

### Switching it off

**Two-Factor Authentication → Disable**, and it asks for **your account password *and* a current code** — six
digits from the app, or an unused backup code. Both, not either. Disabling clears the pairing and all ten backup
codes, so switching it on again starts from a fresh QR code and a fresh set of codes.

## Signed in on too many devices

A user may hold up to **25** sessions at once. Sign in past that from a browser and Lynomia Chat does not refuse
you — it lists the existing sessions and asks which to end, or offers to end all of them. The same list lives in
**Profile Settings → Active sessions**, where you can end a session you no longer recognise without waiting to
be asked.

## Limits

- **Two-factor is per person, not per account.** There is no setting that requires it of everybody, and
  switching it on protects you alone. Encourage it; you cannot enforce it.
- **Two-factor needs the installation to support it.** It depends on encryption keys being configured where
  Lynomia Chat is deployed. Without them the Two-Factor Authentication page sends you back to Profile Settings
  the moment you open it, and the API answers that the feature is unavailable. That is a deployment matter, not
  something you can fix from the dashboard.
- **No administrator in your account can reset a colleague's two-factor.** Password resets, yes; two-factor, no.
  A colleague locked out with no backup codes left needs whoever runs the installation.
- **Repeated failed sign-ins are throttled, not locked.** Five attempts from one IP address in five minutes, and
  ten for one email address in fifteen minutes, then requests are refused for a while. Nothing is permanently
  locked and no email is sent about it, so an unexplained refusal that clears by itself is usually this.
- **Changing your email address signs you out**, because it is the credential you sign in with.
- **Google sign-in is a sign-in, not a second password.** Removing your Google access does not remove your
  Lynomia Chat user, and a user created through Google still has a Lynomia Chat password it can reset.

## Related

- [Your profile and security](your-profile-and-security)
- [Roles and permissions](roles-and-permissions)
- [Invite your team](invite-your-team)
- [Set up your account](set-up-your-account)
- [Open a ticket with Lynomia](contact-lynomia-support)

## If it does not work

**"Invalid login credentials" and I am sure the password is right.** Check the email address for a typo first.
Then consider whether you are hitting the sign-in throttle — wait five minutes and try once, rather than ten
times.

**I get sent to "Verify your email" instead of the dashboard.** The address is not confirmed. Use **Resend** on
that page, or ask for a password reset: completing one confirms the account.

**There is no "Create a new account" link.** Self-service sign-up is switched off on this installation. Ask an
administrator of the business to invite you.

**"Continue with Google" is not on the login page.** Google login is not enabled on this installation, or no
Google client id is configured. Use your email address and password.

**Google says I signed in, Lynomia Chat says no account found.** No Lynomia Chat user has that email address,
and sign-up is disabled, so nothing was created. You need an invitation to the right address.

**Two-Factor Authentication bounces me back to Profile Settings.** The installation does not have two-factor
available. Nothing you do in your profile will change that.

**My authenticator code is always rejected.** The six digits are time-based, so a phone whose clock has drifted
produces codes that are wrong everywhere. Let the phone set its time automatically, then try again, and use a
backup code in the meantime.

**I used my last backup code.** Regenerate immediately, while you still have the authenticator app in your
hand. The next lost phone has nothing left to fall back on.