Sign-in and sign-out

Studio roles: none. Frontend users sign in on the sign-in surface themselves. This page explains what they see.

Sign in

1. On a frontend, the frontend user chooses to sign in. The frontend sends them to the sign-in surface.
2. On "Sign in", they enter their "Email address" and choose "Continue".
3. They enter their "Password" and choose "Sign in".

The sign-in surface then runs the membership check in login mode with their stored member code; they enter nothing. If the result lets them use the frontend, they return to it ("Taking you to Pannoniqa Portal …"). If they hold no membership yet, they see "Confirm your membership", see Sign-up and onboarding.

On a frontend with "Membership mandatory":

• a member who is no longer valid, or no longer in the frontend's community, sees "We could not sign you in" with "Request support";
• if a register cannot be asked, a member whose last valid check is less than 7 days old still gets in on that result (the grace rule). Everyone else sees "Please try again later".

On other frontends, all of them sign in, and the frontend learns that they are not a member of its community.

Single sign-on within the organisation

Once signed in on the sign-in surface, a frontend user who moves to another frontend of the same organisation in the same browser is not asked for their password again ("Signing you in …"). The membership check still runs for each frontend. This sign-in lasts 7 days without use and at most 30 days, then the password is asked again.

The single sign-on never crosses organisations: an account at another organisation is a different account.

Too many attempts

After several wrong passwords for one email address, or too many attempts from one network, the sign-in surface asks the person to wait ("Too many attempts. Please try again after …"). A failed security check shows "The security check failed. Please try again." The check usually runs unseen; now and then it asks the person to tick a box first. If it cannot finish in the browser, the form shows "The security check could not be completed." with "Try again".

A blocked frontend user cannot sign in: they see "We could not sign you in" with "Request support". See Block a frontend user.

Forgotten password

1. On the password screen, the frontend user chooses "Forgot password?".
2. On "Reset your password", they enter their email address and choose "Send link".
3. They open the link in the email. It works for 1 hour and only once; only the newest link works.
4. On "Choose a new password", they enter the "New password" twice and choose "Save password".

They are signed in with the new password and continue to the frontend they started from, or to its start URL. Saving a new password ends every session of the frontend user on all frontends of the organisation, so anyone else signed in with the old password is signed out.

The reset emails go out in your sign-in branding and in the person's language.

Sign out

Signing out of a frontend ends that frontend's session. The frontend can also send the person to the sign-out page of the sign-in surface, which offers two choices:

• "Sign out": signs them out of this browser.
• "Sign out of all websites and apps": also signs them out of every website and app of the organisation, on every device.

Afterwards they return to the frontend's start URL.

An access token a frontend already holds stays valid until it expires, at most 1 hour. New tokens and refreshes stop at once.