> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nexudus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in Codes

> The six-digit email code customers type in the portal to prove an email is theirs when they sign up with an existing account or accept a proposal.

## Overview

Some steps in the Members Portal need proof that the person on the page owns the email address they are using. Instead of sending only a link that opens a new page, the portal emails a **six-digit code** and asks for it in the page the customer is already on. Everything they have filled in stays where it is, and the step carries on as soon as the code is accepted. The same email still contains a link that does the same thing, for customers who prefer to click it.

## When the portal asks for a code

| Situation | What the customer sees | After a correct code |
| - | - | - |
| **Signing up with an email that already has a Nexudus account** (at this location or anywhere else) | After submitting the sign-up form, the dialog changes to **Check your email to continue** with a code field | The sign-up is sent again automatically and the customer is signed in |
| **Typing that email into a sign-up form** | A notice under the Email field offers **Send me a code** in place of the rest of the form | The rest of the form opens so they can finish it |
| **Accepting a proposal for an existing account** | After **Accept and continue**, the dialog changes to **Sign in to accept this proposal** with a code field | The customer is signed in and goes on to the account step of the proposal checkout |

A customer who is already signed in, or whose account is created by that same visit (a new customer accepting a proposal), is never asked for a code.

## What the customer does

**1. Open the email**

The email arrives with the subject **Your verification code for** followed by the location name. During sign-up, the dialog shows a shortcut to the customer's mailbox (Gmail, Outlook, iCloud or Yahoo) when it recognises the address.

**2. Type or paste the code**

The code is checked as soon as six digits are entered. Spaces and dashes copied with it are ignored, and phones offer to fill the code in from the email or message.

**3. Carry on**

A wrong code clears the field and says why. **Send a new code** (or **send it again** during sign-up) emails a fresh one.

> [!TIP]
>
> On a proposal, **Sign in with your password instead** takes the customer to the sign-in page, which brings them back to the proposal once they are signed in.

## The email

The code arrives in its own email template, **SignInCode**, which you can customise in **Settings → Email editor** like any other customer email. It is available in English, Spanish, French, German, Italian, Dutch and Portuguese. Keep these merge tags in any version you edit:

| Merge tag | What it inserts |
| - | - |
| `{signincode}` | The six-digit code |
| `{signinlink}` | A link that does the same as the code: it signs the customer in, or confirms their address for sign-up, and brings them back to the page they were on |
| `{signincodeminutes}` | How long the code lasts, in minutes |

> [!NOTE]
>
> If you remove `{signincode}` from your version of the template, customers will see a code field but receive no code. They can still use the link in the email.

## Limits and security

* A code lasts **30 minutes** and works **once**. Signing in with the link from the same email also uses up the code, and a newer email replaces the code in the older one.
* After **5 wrong codes** the code stops working and the customer needs a new one. After **20 wrong codes within 24 hours** the account cannot use codes until that period has passed; the link in the email still works.
* Wrong codes also count towards the limit on failed sign-ins from one network, which wrong passwords share.
* At most **5 code emails** are sent to an account in 15 minutes.
* Customers with **two-factor authentication** on their account are sent to the sign-in page instead, where they use their authenticator app. A code alone cannot sign them in.

## Older portals

Portals that do not ask for codes keep working as before: their customers receive the previous emails (**SignupRestore** for sign-up verification and **MagicLink** for existing customers), which carry the link alone. A portal running against a platform version without codes also falls back to the link-only message.

## Related

* [Sign In](https://learn.nexudus.com/member-portal/auth/sign-in.md)
* [Email templates](https://learn.nexudus.com/platform/settings/email-templates.md)
* [Check Sign-up Email](https://learn.nexudus.com/api/endpoints/checkout/check-email.md)
* [Send Verification Email](https://learn.nexudus.com/api/endpoints/checkout/restore.md)
* [Verify Sign-in Code](https://learn.nexudus.com/api/endpoints/checkout/verify-code.md)
* [Send Proposal Sign-in Code](https://learn.nexudus.com/api/endpoints/proposals/proposal-login-code.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.