Signing in

The address you use decides who you're signing in as

LMS has no separate "select your organization" step - the address in your browser does that automatically:

• https://ed-tech.pro (the apex domain, no subdomain) → superadmin sign-in
• https://<subdomain>.ed-tech.pro (e.g. https://acme.ed-tech.pro) → sign-in scoped to that tenant

This means a tenant's users should always be given their own subdomain's URL to sign in at, never the bare ed-tech.pro address - signing in from the wrong address won't let a tenant user in (the platform has no account matching them there).

First sign-in: setting a password

Accounts created by someone else (via tenant creation or user creation) start with a temporary password, shown once at creation time to whoever created the account. A new user (or support agent, or anyone whose password was reset) is also emailed the same temporary password directly - the one exception is a superadmin-created tenant's own founding admin, created before any real email address exists on file for them, so that one still needs to be passed along by whoever created the tenant.

On that first sign-in, you'll be prompted to set a permanent password before continuing - this happens once per account.

A self-serve signup is the one path where none of this applies: you choose your own real password during signup itself, it's already permanent, and there's no first-sign-in prompt.

Self-serve signup

Anyone can create their own tenant from the marketing homepage, no invitation needed:

1. From the homepage, click Get started and provide a work email, an organization name, and a subdomain (auto-suggested from the organization name, editable).
2. A 6-digit code is emailed to that address - it expires after 15 minutes, and too many wrong guesses (5) locks that attempt, so signup has to be restarted.
3. Enter the code and choose a password. This creates the tenant and its founding admin account, with that password set as permanent immediately - no temporary password, no forced change on next sign-in.
4. You're redirected straight to your new tenant's own sign-in page (https://<subdomain>.ed-tech.pro) to sign in.

A subdomain can only be used once - if it's taken, you'll be told before a code is even sent. Starting signup again with the same email sends a new code and makes the old one stop working, so always use the most recent code you received.

Staying signed in

A session lasts about an hour before it needs to silently refresh in the background; this happens automatically while you're active in the app. If you're inactive long enough that the refresh itself expires (about 30 days), you'll be asked to sign in again.

Signing out

Use the sign-out control in the sidebar (bottom-left, next to your name). This ends your session on this device only.

Social login (mobile app)

On the mobile app's sign-in screen, members may also see "Sign in with Google"/"Sign in with Apple" buttons below the username/password fields - which ones appear (if any) is a per-tenant choice, made by that tenant's admin on the Feature settings page, and only once a platform administrator has separately made social login available to that tenant at all (see Feature flags). This only controls button visibility, not which sign-ins Cognito itself will accept - see docs/ADR.md's ADR-058 if you need the full reasoning.