Create an account
Email/password registration, verification, and session basics.
Last updated 2026-09-01
What it is
An Application user account is identified by email. Authentication is email and password only — there is no OAuth or SSO for end users. After login, the browser receives an httpOnly session cookie _i_s (Redis-backed).
Who can access
Anyone can register. Some actions (joining a Business via invite, creating a Business) require a verified, signed-in account.
How to
Register
- Open the register page and submit email and password
- Complete email verification using the link or code from the verification email
- Sign in with the same credentials
After sign-in
- Create a Business, or accept a pending invitation
- Manage password, email change, and recovery email from user settings
- Sensitive changes may require re-authentication
Password recovery
- Use forgot password, verify the reset challenge, then set a new password
- You can cancel an in-progress reset from the recovery flow if needed
Constraints
- No social login, OAuth, or SSO
- Session cookie _i_s is httpOnly — do not expect to read it from client JavaScript
- Account self-delete is not available in-product; request via support
- Rate limits apply on register, login, and verification endpoints