Signing In and Account Security

This article explains how people sign in to the Qik dashboard and to your own apps, how one-time codes and lockouts work, and how to reset a password — for yourself or for someone else.

Signing in to the dashboard

Go to the dashboard sign-in page ("Welcome back — Sign in to your qik account") and choose one of:

• Email Address and Password, then Login.
• Continue with Google or Continue with Apple.

Your Qik account is the same in every organisation you belong to. After signing in you land in your default organisation; use the account menu → Switch Organisation to move to another one.

The one-time code (multi-factor authentication)

Every dashboard sign-in with an email and password has a second step:

1. After you enter your password, the page changes to One Time Password and Qik emails you a short numeric code (subject: "Your MFA one time password").
2. Enter the code in Multi Factor Passcode and click Login.

Things worth knowing about codes:

• Each code is valid for 10 minutes and can be used once.
• If your email is slow and you ask for another code, the earlier ones keep working: any of your three most recent unexpired codes will be accepted.
• Once you're signed in, all of your outstanding codes are cancelled.
• Signing in with Google or Apple doesn't need a Qik code, because the provider has already verified you.

Failed attempts and lockout

A wrong password and a wrong one-time code both count as a failed attempt. The first three failures have no penalty. From the fourth failure in a row, the account is locked for a short, growing delay after each failure, and the sign-in page shows "This account has been locked. Please try again in N seconds". The delay starts at a few seconds and grows with each further failure.

The failure count only goes back to zero after a complete successful sign-in (correct password and correct code). If you're locked out, wait for the delay to pass, or reset your password.

Creating an account and confirming your email

When you sign up with an email and password, Qik emails you a code to finish signing up. Until you've proved you own your email address (with that code, a verification link, a completed password reset, or by signing in with Google or Apple), your account is treated as unverified. While unverified:

• Pending dashboard invitations sent to your address aren't accepted yet.
• Profiles with your email address aren't linked to your login yet.

Both happen automatically as soon as your address is confirmed. This stops someone signing up with another person's email to claim their invitations.

Password rules

Passwords must:

• be at least 7 characters long;
• not be the word "password";
• not contain a run of four or more sequential digits (such as 1234 or 9876);
• not repeat the same character five or more times in a row.

Longer passphrases are better than short complex ones.

Resetting your own dashboard password

1. On the sign-in page click Forgot your password?
2. Enter your Email Address and click Submit. You'll see "Instructions to reset your password have been sent to you via email". (You see the same message whether or not the address has an account, so the form can't be used to find out who uses Qik.)
3. Open the link in the email. It works once and expires after 12 hours.
4. Check your first and last name, enter a new password in Password and Please Confirm Password, and click Continue. You're signed in straight away.

If you change the email address on that page, the new address isn't used until you confirm it from a link sent to the new address.

If you are already signed in when you open a reset link, you'll be asked to sign out first.

Signing out

Open the account menu in the top bar and choose Logout. This ends your session in that browser. If an administrator changes your access (for example removes an access pass) while you're signed in, your open sessions are told that your access has changed.

App logins (your own apps and websites)

People who sign in to apps and websites you build on Qik use an app login, which belongs to your organisation only and has its own password. See People, Users and Logins for how app logins differ from dashboard logins.

Requiring a one-time code for app sign-in

One-time codes are optional for app logins. You can require them in two places:

• For everyone signing in to an application — open the application and switch on Require MFA (shown once sign-in is enabled for the application).
• For one person — open their app login and switch on Require MFA.

Either way, after entering their password the person is emailed a code that is valid for 10 minutes. For app logins, entering a wrong code cancels all of that person's outstanding codes, so they'll need to request a new one. Codes don't apply to Google or Apple sign-in.

App password resets and invitations

• A reset link someone requests for an app expires after 12 hours; an app invitation link (sent with Send App Invitation) lasts 7 days. Both work once.
• After choosing a new password, the person is signed straight in to the application the link was for.
• An app login created through Google or Apple sign-in has no password; if the person later wants to sign in with a password, they reset it first.

For builders: when Qik sends someone back to your website already signed in (after Google or Apple sign-in, an app invitation or a password reset), the link carries a single-use sign-in code in the refreshToken query parameter instead of a long-lived token. It expires after five minutes and is exchanged for a session in the usual way.

Helping someone else

If you can manage users, you can send a reset link on someone's behalf:

1. Find their login under People → Users.
2. Use the Send Password Reset Link action.
3. For an app login, choose which application the password is for. For a dashboard login, the email goes to their Qik account address.

A dashboard login that hasn't accepted its invitation yet has no password; use Send Invitation Link instead. You can't see or set anyone's password yourself.

Good practice

• Turn on Require MFA for any app where logins can see personal or financial information.
• Remove access passes, or block the login, as soon as someone leaves — don't rely on them simply not signing in.
• Give each person their own login. Shared logins make the activity history meaningless and can't be locked out individually.

FAQs