Skip to content

Registration & login security

Who may sign up, and how everyone proves who they are. 20 minutes, and worth thinking about rather than ticking boxes.

Sidebar → Settings → Registration

When a school signs up

Verification

SettingWhat it does
Enable Email VerificationSends a verification link to the admin's email after they register
Enable WhatsApp OTP VerificationSends a 6-digit code by WhatsApp to prove the phone number is real

Turning both on is not double work

If both are enabled, the WhatsApp OTP becomes the main gate and email is verified automatically once the code is entered. The school does one check, not two.

WhatsApp OTP needs the WhatsApp gateway working first

It requires the platform WhatsApp gateway configured with a valid API key and sender number. Switch this on without that and registration breaks — nobody can complete signup.

Stopping bots

Enable Math Captcha adds a simple sum to the registration form. It is on by default and there is rarely a reason to turn it off — without it, a public registration page collects junk signups within days.

How people log in

Four options, and they combine.

OptionWhat it meansGood for
Password (always available)The normal wayEveryone
Two-Factor LoginAn OTP after the passwordSchools handling money and student data
Passwordless LoginA "Sign in with OTP" button instead of a passwordStaff who forget passwords constantly
Face LoginFace recognition from the app or the webSchools already using face attendance

Face Login needs server-side face processing

Face data is stored and matched on the server, which needs Node.js — so this is VPS only. It cannot work on shared hosting. See which hosting do I need.

Passwordless is the quiet support-cost saver

"I forgot my password" is one of the most common school requests. A Sign in with OTP button removes it entirely — the user gets a code and is in, with no reset link, no email delay and no ticket to you.

The Platform Master OTP

A single six-digit code that works for any school login on the platform.

Treat this like a master key to every school

It bypasses normal login for every school on your installation. Anyone holding it can sign in as any school.

  • Set it to something long-lived and genuinely random, never a memorable number
  • Store it where you store your other critical passwords, not in a chat message or a support email
  • Change it whenever someone who knew it stops working with you
  • Never send it to a school "just to get them in" — reset their password instead

It exists for emergencies, such as a school locked out with no working email. It is not a support shortcut.

Leaving the field empty keeps whatever is already set — it does not clear it.

Telling a new school they exist

SettingSends
Send SMS to School AdminA text after registration
Send WhatsApp to School AdminA WhatsApp message after registration

Both need the matching gateway configured — SMS or WhatsApp. With no gateway, nothing sends and no error appears.

What I would switch on

If you…Turn on
Let schools register themselvesEmail verification, math captcha, and WhatsApp OTP if your gateway is live
Create every school yourselfCaptcha only — you already know who your customers are
Handle fee payments for many schoolsTwo-factor login as well
Get constant password-reset requestsPasswordless login
Run on shared hostingEverything except face login

Common problems

What you seeCause
Nobody can complete registrationWhatsApp OTP is on but the gateway is not configured
Verification emails never arriveEmail is not set up, or the cron job is not running
OTP codes never arriveSame — the gateway sends through the queue
Face login option missingFace processing is unavailable on this server
A school is locked out entirelyReset the admin's password from their school record. Use the master OTP only as a last resort