← Back to documentation

Account Access

Complete guide to authentication workflows in PayloadRelay, including SSO and recovery.

8 min read

Use this guide for login, recovery, confirmation, and invitation access flows.

Purpose

This page covers:

  • Verification-first signup.
  • Login (password and provider identity).
  • Password reset request + consume.
  • Email-change confirmation preview + consume.
  • Organization invitation preview + accept.

Prerequisites and permissions

  • Access to the sign-in, password reset, email confirmation, and invitation pages.
  • Signup may not be available for every workspace.
  • Valid links are required for confirmation, reset, and invitation flows.

Step-by-step workflow

A. Create an account

  1. Open signup and enter any valid email address.
  2. Open the secure link sent to that address. PayloadRelay has not created a user, password, or workspace yet.
  3. Enter your name, choose a password, accept the Terms of Service and Privacy Policy, and create the account. Provider-pending signup asks you to authenticate with the same provider account again instead of creating a password.
  4. You are signed in and routed to onboarding.

The link is single-use and expires after 24 hours. If you use Microsoft signup, the Microsoft email claim is only a suggestion: you can enter the mailbox you want PayloadRelay to verify. The completion page then requires the same Microsoft account again, preventing another provider identity from being attached to the verified mailbox.

B. Sign in

  1. Open the sign-in page.
  2. Choose email/password, or a named provider button (Google, Microsoft, Apple) when enabled.
  3. Successful sign-in redirects you to the app.

Login and signup have separate meanings. A provider button on login never creates or silently links an account. Provider identity is the provider plus its stable account identifier, not an email match.

C. Reset password

  1. Open the password reset request page.
  2. Submit your email address.
  3. Open the reset link from your email.
  4. Enter and submit your new password.

Rules:

  • New passwords are 15–128 Unicode characters. Spaces and passphrases are supported.
  • Common or compromised choices are rejected. A password manager-generated password is recommended.
  • Reset links are single-use and time-bound.
  • Reset works for provider-only accounts too, allowing the verified mailbox owner to establish password login.
  • Successful reset signs out existing sessions; sign in with the new password afterward.

D. Confirm an email change

  1. Open the confirmation link from email.
  2. Review the page, then choose Confirm email. Previewing the link does not consume it.
  3. Sign in with the new email address. Email-change links do not create a session.

Changing the account email requires a current-password check or provider authentication from the last 10 minutes. All older sessions are invalidated when the change is confirmed.

E. Accept organization invitation

  1. Open the invitation acceptance link.
  2. Review the organization invitation details.
  3. Set a display name and password.
  4. Accept the Terms of Service and Privacy Policy.
  5. Submit the invitation acceptance form.

Rules:

  • Password must be at least 15 characters and pass the same common-password check as signup/reset.
  • Password and confirmation must match.

Expected result and verification checks

  • Login grants access to authenticated pages.
  • Reset flow allows login with the new password.
  • Signup completion creates the account only after mailbox ownership is proven.
  • Email-change confirmation updates the address without signing in the link recipient.
  • Invitation acceptance creates account access in the target organization.

Common issues and fixes

  • Missing token error: use the latest link from email.
  • OAuth button missing: provider is not configured in this environment.
  • Invitation rejected: token may be expired/revoked; ask org admin to resend.
  • Login denied after account changes: clear stale cookies and retry.
  • Sensitive change says reauthentication is required: repeat password or provider sign-in, then retry within 10 minutes.
  • Provider email already belongs to an account: sign in using that account's existing method. PayloadRelay never auto-links accounts by email.
  • Provider signup or binding-review link expired: restart signup or sign-in with the same provider. The local email-signup resend action does not recreate provider-bound links.

Related guides

← Back to documentation