Skip to main content

​
Overview

Some steps in the Members Portal need proof that the person on the page owns the email address they are using. Instead of sending only a link that opens a new page, the portal emails a six-digit code and asks for it in the page the customer is already on. Everything they have filled in stays where it is, and the step carries on as soon as the code is accepted. The same email still contains a link that does the same thing, for customers who prefer to click it.

​
When the portal asks for a code

A customer who is already signed in, or whose account is created by that same visit (a new customer accepting a proposal), is never asked for a code.

​
What the customer does

1

Open the email

The email arrives with the subject Your verification code for followed by the location name. During sign-up, the dialog shows a shortcut to the customer’s mailbox (Gmail, Outlook, iCloud or Yahoo) when it recognises the address.
2

Type or paste the code

The code is checked as soon as six digits are entered. Spaces and dashes copied with it are ignored, and phones offer to fill the code in from the email or message.
3

Carry on

A wrong code clears the field and says why. Send a new code (or send it again during sign-up) emails a fresh one.
On a proposal, Sign in with your password instead takes the customer to the sign-in page, which brings them back to the proposal once they are signed in.

​
The email

The code arrives in its own email template, SignInCode, which you can customise in Settings → Email editor like any other customer email. It is available in English, Spanish, French, German, Italian, Dutch and Portuguese. Keep these merge tags in any version you edit:
If you remove {signincode} from your version of the template, customers will see a code field but receive no code. They can still use the link in the email.

​
Limits and security

  • A code lasts 30 minutes and works once. Signing in with the link from the same email also uses up the code, and a newer email replaces the code in the older one.
  • After 5 wrong codes the code stops working and the customer needs a new one. After 20 wrong codes within 24 hours the account cannot use codes until that period has passed; the link in the email still works.
  • Wrong codes also count towards the limit on failed sign-ins from one network, which wrong passwords share.
  • At most 5 code emails are sent to an account in 15 minutes.
  • Customers with two-factor authentication on their account are sent to the sign-in page instead, where they use their authenticator app. A code alone cannot sign them in.

​
Older portals

Portals that do not ask for codes keep working as before: their customers receive the previous emails (SignupRestore for sign-up verification and MagicLink for existing customers), which carry the link alone. A portal running against a platform version without codes also falls back to the link-only message.