Account Access

Use the account access pages for sign-in, password recovery, email changes, and invitations.

7 min read

Use this guide for a sign-in, an account recovery, an email change, and an organization invitation.

Purpose#

This page covers these tasks:

Sign up after you prove that you own the email address.
Sign in with a password or with a provider account.
Connect more than one sign-in method to the account.
Request and complete a password reset.
Change the account email address.
Accept an organization invitation with a password or with a provider account.

Before you start#

Access to the sign-in page, the password reset page, the email confirmation page, and the invitation page.
Signup is not always available.
The confirmation flow, the reset flow, and the invitation flow need a valid link.

Procedure#

A. Create an account#

Open the signup page and enter a valid email address.
Open the secure link that PayloadRelay sends to that address. PayloadRelay does not create a user, a password, or an organization before this step.
Enter your name, set a password, accept the Terms of Service and the Privacy Notice, and create the account. If the signup started with Google, Microsoft, or Apple, sign in with the same provider account and do not create a password.
PayloadRelay signs you in and sends you to the onboarding page.

The link has one use, and it expires after 24 hours. If the address already has an active account, PayloadRelay sends a notice to that account instead of a signup link. The notice has a link to the sign-in page and a link to the password reset page. For a Microsoft signup, enter the email address for the confirmation. After you open the link, sign in with the same Microsoft account again. This prevents the use of the confirmed email address by a different account.

If you select a provider button on the signup page, and that provider account is already connected to a PayloadRelay account, PayloadRelay signs you in to that account. It does not create a second account, and it does not send a signup link.

Open the sign-in page.
Enter your email address and password, or select a provider button (Google, Microsoft, Apple) if it is enabled.
After a successful sign-in, PayloadRelay sends you to the app.

A session stays valid for 24 hours after the last request, and for a maximum of 30 days after the sign-in. After that, sign in again. After 10 failed password attempts in 15 minutes, PayloadRelay refuses the password checks for that address from your network address. Wait 15 minutes, then try again.

A sign-in and a signup are different. A provider button on the sign-in page never creates an account, and it never links an account. A provider sign-in uses the selected provider account, and not only the email address of that account.

If the provider account is not connected to a PayloadRelay account, PayloadRelay refuses the sign-in. For Google and Apple, the message can tell you what to do next:

"An account uses this email address. Sign in with {methods}. Then connect {Provider} in Settings.": sign in with one of the named methods. Then connect the provider in Settings -> Security.
"An organization invited this email address. To join it, open the invitation link in your email.": open the invitation link in your email. Then accept the invitation.

C. Reset password#

Open the password reset request page.
Submit your email address.
Open the reset link in your email.
Enter and submit your new password.

Rules:

A new password has 15 to 128 Unicode characters. You can use spaces and passphrases.
PayloadRelay rejects a common password. To create a password, use a password manager.
A reset link has one use, and it expires after 2 hours.
You can also use the reset flow for a provider-only account. The owner of the confirmed mailbox can create password access. The email inbox is the recovery route for the account, and the usual sign-in method has no effect on this. Protect the mailbox, because the protection of the provider account does not protect PayloadRelay alone. The connected provider sign-ins do not change. PayloadRelay adds the password to the Sign-in methods list in Settings -> Security.
A successful reset signs out the current sessions. Then sign in with the new password.
A successful reset also confirms the email address of the account, because the reset link proves that you own the mailbox.

D. Complete an email change#

Open the confirmation link in the email.
Read the page, then select Confirm email. A preview of the link does not consume it.
Sign in with the new email address. An email-change link does not create a session.

To change the account email address, you must give the current password, or you must authenticate with a connected provider in the last 10 minutes. When the change completes, PayloadRelay ends all the older sessions.

E. Accept organization invitation#

Open the invitation acceptance link.
Read the organization invitation details.
Enter a display name.
Accept the Terms of Service and the Privacy Notice.
Select one of these sign-in methods:
- To use a password, enter the password and the confirmation. Then select Join organization.
- To use a provider account, select the Google button, Accept with Apple, or Accept with Microsoft. Then sign in to the provider account.

Rules:

The password must have 15 to 128 Unicode characters. It must pass the same common-password test as the signup flow and the reset flow.
The password and the confirmation must be the same.
A provider acceptance needs no password. The display name is optional. If you leave it empty, PayloadRelay uses the name from the provider.
The provider email address does not have to match the invitation address. The invitation link proves that you own the invited mailbox.
If a different PayloadRelay account uses the provider account, PayloadRelay refuses it. Select a different sign-in method.
After the acceptance, the account has only the method that you used. To add a method, use Settings -> Security.
If you accept an invitation for a removed account, PayloadRelay removes the old password and the old provider sign-ins of that account.

An account can have a password and one account of each provider: Google, Apple, and Microsoft. You can sign in with each of them. To connect or remove a sign-in method, use Settings -> Security. See the Settings Guide.

Expected result#

A sign-in gives access to the authenticated pages.
After the reset flow, you can sign in with the new password.
The signup creates the account only after you prove that you own the mailbox.
The email-change confirmation updates the address. It does not sign in the person who opens the link.
The invitation acceptance creates account access in the organization.

Common issues and fixes#

A missing-token error: use the most recent link in the email.
The sign-in says that the email address is not confirmed: select the link under the message to send a new signup link. If you cannot sign in, use the password reset flow, because a completed reset confirms the address.
The OAuth button is not present: that sign-in method is not available now.
The browser blocked the sign-in window: allow pop-up windows for the site. Then try again. In the browser of a mobile app, such as Gmail, LinkedIn, or Instagram, open the page in your usual browser.
The provider window closed before the sign-in completed: select the provider button again. The new attempt replaces the old one.
The Microsoft sign-in says that your organization must approve PayloadRelay: ask your Microsoft administrator to approve PayloadRelay.
PayloadRelay rejects the invitation: the invitation can be expired, revoked, or declined, or a newer invitation replaced it. Ask an organization admin to send a new invitation.
You do not want to join the organization that invited you: open the invitation link and select Decline invitation. After that, you can sign up with the email address.
PayloadRelay refuses the sign-in after an account change: delete the old cookies and try again.
A sensitive change asks for authentication again: sign in again with the password or with a connected provider. Then try again in the next 10 minutes.
The provider email address belongs to an account already: sign in with the existing sign-in method of that account. Then connect the provider in Settings -> Security. PayloadRelay never links accounts automatically by email address.
The signup says that an organization invited the email address: open the invitation link in your email to join that organization. PayloadRelay does not create a separate account for an invited address.
The provider signup link or the connection-review link expired: start the signup again, or sign in with the same provider. The Resend action on the email signup screen sends an email-signup link only. It cannot create a provider signup link or a connection-review link.

← Back to documentation