Authentication overview.

The platform provides secure, modern authentication options for all user types. This guide covers how users sign in and how administrators can configure authentication.

Login methods

One-time passwords (OTP) (recommended)

The app’s default login experience is email OTP: the user receives a short-lived verification code and enters it to sign in. Members always use OTP, while Partners, Admins and Staff use OTP-only authentication until they choose to set a password (in Account settings).

How it works:

1. User enters their email address
2. System sends a 6-digit code
3. User enters the code
4. User is logged in

Why this is the default:

• No password to remember
• Fast onboarding (members most of all)
• Strong rate limiting + short expiration window

Password login (optional)

Accounts can also sign in with a password if a password is set. Members always use OTP, while Partners, Admins and Staff can set a password (Account settings) if they wish.

How it works:

1. User enters email + password
2. System authenticates and starts a session

User-specific login

Administrators

Access the admin panel at /admin.

• Full platform access
• OTP and password login supported
• Session duration configurable

Partners

Access the partner dashboard at /partner.

• Partner-specific dashboard
• View only their own data
• Manage their loyalty programs

Staff

Access the staff interface at /staff.

• Simplified mobile-friendly interface
• Quick QR scanning access
• Transaction processing only

Members

Access via the main site homepage.

• Can browse without signing in
• Login required to collect cards
• Always uses OTP login
• On a phone, a guest sees the same app-like bottom tab bar: the first tab reads Sign in and leads to login, and More holds sign in and create-account. On a larger screen, sign in sits in the top header.

Anonymous member mode

For businesses where signup friction loses customers, anonymous mode lets visitors take part without signing up.

How it works:

1. Visitor arrives at your loyalty program
2. The app creates a member account
3. They receive a unique code (e.g., "R4K7")
4. Full access from the start: earn points, collect stamps, claim rewards
5. You can add an email anytime to enable OTP login on any device
6. If you already have an account with an email, use Log in with Email in the Switch Account tab to verify your email and switch

Best for: Cafés, quick-service restaurants, pop-ups, events. Anywhere speed matters.

💡 Learn more: Anonymous Members: Full configuration guide

Security features

OTP expiration

One-time passwords expire after 10 minutes. Expired codes require a new request.

Rate limiting

OTP limits are keyed on the email address, not the IP address: each address gets a capped number of code requests per window, a capped number of verification attempts per code, and a cooldown between resends. The limits are fixed in the application code; there is nothing for an administrator to configure. See OTP management for the exact numbers.

Blocking access

There is no session list to manage and no per-user remote logout. To shut an account out, deactivate it: clear the account's Active toggle, and the app blocks it on its next request. One exception exists for anonymous members: when you disable anonymous mode in Settings, a one-time Also log out anonymous members option ends all sessions for members who have not added an email address.

Related topics

• Anonymous members: Zero-friction onboarding
• OTP management: One-time password configuration
• Security monitoring: Security settings