What to check when you cannot sign in
How to tell the causes apart when you cannot sign in. Five failures lock you out for 15 minutes, and the wording on the screen does not change.
- Help category
- Account
When you cannot sign in, the message on the screen narrows the cause down in almost every case. The exception is the 15 minute lockout, where the wording is the same as it is for a mistyped password.
Telling the causes apart
| Message | Cause | What to do |
|---|---|---|
| "Your email address or password is incorrect." | A wrong password, or a 15 minute lockout | Leave it 15 minutes, or go to the reset |
| "Your email address has not been verified yet." | The URL in the confirmation email has not been opened | "Resend confirmation email" |
| "Authentication failed. Please double check your code." | A wrong MFA code, or a clock that has drifted | Put the device clock back on automatic |
| The tab changes to the sign-in screen on its own | The session ended after 8 hours of no activity | Sign in again |
| "You cannot access Platform Admin" | No active membership | Ask an administrator of the organisation |
Repeated attempts on the sign-in screen reach the 15 minute lockout before they reach the rate limit. On the Quick schedule screens, which are used without an account, the rate limit comes first instead and "ThrottlerException: Too Many Requests" appears. Leave it about a minute, then try again.
The email address has not been verified yet
You cannot sign in until the URL in the confirmation email has been opened. In that state the screen reads "Your email address has not been verified yet. Please complete your registration using the URL in the confirmation email.", with "Resend confirmation email" alongside it. The URL is good for 24 hours.
Attempts made while verification is still outstanding count as failures as well, so repeating them brings on the lockout. Resending shows "We have resent the confirmation email. Please check your inbox.", and the wording is the same when nothing has been sent. Nothing is sent when there is no account for the address, and nothing is sent when the address has already been verified.
If it does not arrive, check the spam folder and the spelling of the address, then go through the steps in "Creating an account".
Five failures and you cannot sign in for 15 minutes
Five failures on the same email address lock it for 15 minutes. While it is locked, the correct password is refused too. A successful sign-in clears both the failure count and the lock on the spot.
Resetting the password
Send it from "Reset password" on the sign-in screen. An address with no account behind it gets the same "If you have a registered account, we have sent you a reset email.", so the screen never tells you whether the address is registered.
- The URL is good for 1 hour. Once it has expired, ask for a new one.
- The last five passwords cannot be reused.
- No reason is given when it fails. An expired URL and a reused password both come back as the one message, "Unable to register new password."
- Completing it revokes every session that person has. Your other devices have to sign in again.
A tab you opened yesterday has signed itself out
A session ends after 8 hours of no activity, and you are asked to sign in again. Activity keeps extending it; the longest you can go without signing in again is 30 days.
Nothing is shown as an error when it ends. The tab moves to the sign-in screen on its own, and after signing in you are put back on the page you were on. That return only covers pages under /app, /admin, /quick and /invite.
Setting up and using two-factor authentication (MFA)
The setting is "Two-factor authentication (MFA)" in the left-hand menu. If it reads "Multi-factor authentication is not configured in this environment. Contact your administrator.", it is not available in that environment. With it on, "Enter verification code" follows the password and asks for the six digit code or a recovery code.
TOTP works off the clock on the device, so a clock that has drifted makes the codes fail. Turning it off takes step-up verification and a TOTP code (or a recovery code).
Signing in with Google, and corporate SSO
Google is the only external identity you can sign in with; there is no Microsoft button. "No account found" appears only when not a single account matches the address held on the Google side, and you are then asked whether to create one. If you are already registered under a different email address, sign in with that address rather than creating one.
In organisations on corporate SSO, choose OIDC or SAML under "Corporate SSO" on the sign-in screen and enter the "Workspace ID". That ID is not shown in the organisation settings, so if you do not know it, check through the contact form.
Signed in, but nothing lets you in
When a membership is set to "Suspended", signing in still works but no active membership is left. You are sent to the screens meant for the operators and stop at "You cannot access Platform Admin". How memberships are handled is covered in "Inviting members and managing your organisation".
If you have joined one organisation only, it is chosen for you. With two or more, "Choose an organization" appears straight after signing in, and from then on you move between them with "Switch organization" in the header. Memberships marked "Invited" appear in neither.
When only some of what you do is blocked, the re-authentication has expired. If "Your identity verification has expired. Verify again to continue." appears, enter your password again.