Appearance
Registration & login security
Who may sign up, and how everyone proves who they are. 20 minutes, and worth thinking about rather than ticking boxes.
Sidebar → Settings → Registration
When a school signs up
Verification
| Setting | What it does |
|---|---|
| Enable Email Verification | Sends a verification link to the admin's email after they register |
| Enable WhatsApp OTP Verification | Sends a 6-digit code by WhatsApp to prove the phone number is real |
Turning both on is not double work
If both are enabled, the WhatsApp OTP becomes the main gate and email is verified automatically once the code is entered. The school does one check, not two.
WhatsApp OTP needs the WhatsApp gateway working first
It requires the platform WhatsApp gateway configured with a valid API key and sender number. Switch this on without that and registration breaks — nobody can complete signup.
Stopping bots
Enable Math Captcha adds a simple sum to the registration form. It is on by default and there is rarely a reason to turn it off — without it, a public registration page collects junk signups within days.
How people log in
Four options, and they combine.
| Option | What it means | Good for |
|---|---|---|
| Password (always available) | The normal way | Everyone |
| Two-Factor Login | An OTP after the password | Schools handling money and student data |
| Passwordless Login | A "Sign in with OTP" button instead of a password | Staff who forget passwords constantly |
| Face Login | Face recognition from the app or the web | Schools already using face attendance |
Face Login needs server-side face processing
Face data is stored and matched on the server, which needs Node.js — so this is VPS only. It cannot work on shared hosting. See which hosting do I need.
Passwordless is the quiet support-cost saver
"I forgot my password" is one of the most common school requests. A Sign in with OTP button removes it entirely — the user gets a code and is in, with no reset link, no email delay and no ticket to you.
The Platform Master OTP
A single six-digit code that works for any school login on the platform.
Treat this like a master key to every school
It bypasses normal login for every school on your installation. Anyone holding it can sign in as any school.
- Set it to something long-lived and genuinely random, never a memorable number
- Store it where you store your other critical passwords, not in a chat message or a support email
- Change it whenever someone who knew it stops working with you
- Never send it to a school "just to get them in" — reset their password instead
It exists for emergencies, such as a school locked out with no working email. It is not a support shortcut.
Leaving the field empty keeps whatever is already set — it does not clear it.
Telling a new school they exist
| Setting | Sends |
|---|---|
| Send SMS to School Admin | A text after registration |
| Send WhatsApp to School Admin | A WhatsApp message after registration |
Both need the matching gateway configured — SMS or WhatsApp. With no gateway, nothing sends and no error appears.
What I would switch on
| If you… | Turn on |
|---|---|
| Let schools register themselves | Email verification, math captcha, and WhatsApp OTP if your gateway is live |
| Create every school yourself | Captcha only — you already know who your customers are |
| Handle fee payments for many schools | Two-factor login as well |
| Get constant password-reset requests | Passwordless login |
| Run on shared hosting | Everything except face login |
Common problems
| What you see | Cause |
|---|---|
| Nobody can complete registration | WhatsApp OTP is on but the gateway is not configured |
| Verification emails never arrive | Email is not set up, or the cron job is not running |
| OTP codes never arrive | Same — the gateway sends through the queue |
| Face login option missing | Face processing is unavailable on this server |
| A school is locked out entirely | Reset the admin's password from their school record. Use the master OTP only as a last resort |