Authentication Overview
Login methods and security options for all users
The platform provides secure, modern authentication options for all user types. This guide covers how users log in and how administrators can configure authentication.
Login Methods
Passwordless Login (Recommended)
The primary login method uses magic links sent via email. No passwords required.
How it works:
- User enters their email address
- System sends a secure magic link
- User clicks the link
- User is logged in automatically
Benefits:
- No passwords to remember or reset
- More secure (no password database to breach)
- Faster login experience
- Works on any device
One-Time Passwords (OTP)
Numeric codes delivered via email for additional security.
How it works:
- User enters their email address
- System sends a 6-digit code
- User enters the code
- User is logged in
Best for:
- Users who prefer codes over links
- Mobile devices where link clicking is cumbersome
- Higher-security environments
User-Specific Login
Administrators
Access the admin panel at /admin.
- Full platform access
- All authentication methods available
- Session duration configurable
Partners
Access the partner dashboard at /partner.
- Partner-specific dashboard
- View only their own data
- Manage their loyalty programs
Staff
Access the staff interface at /staff.
- Simplified mobile-friendly interface
- Quick QR scanning access
- Transaction processing only
Customers
Access via the main site or wallet.
- Can browse without logging in
- Login required to collect cards
- Passwordless experience
Security Features
Magic Link Expiration
Magic links expire after a configurable period (default: 15 minutes). Expired links prompt users to request a new one.
OTP Expiration
One-time passwords expire after a configurable period (default: 10 minutes). Expired codes require a new request.
Session Management
Active sessions can be managed by administrators. Users can be logged out remotely if needed.
Rate Limiting
To prevent abuse:
- Maximum login attempts per hour
- Configurable lockout periods
- IP-based rate limiting
Related Topics
- Passwordless Login — Detailed magic link guide
- OTP Management — One-time password configuration
- Security Monitoring — Security settings