Getting started
Signing in and your account security
How staff sign in, two-factor codes, invitations, forgotten passwords and lockouts.
Sign in
Staff sign in at /app/login with their username or email and password. Customers and
carriers use a different page, /app/portal/login; see How the portals work.
- Where
- /app/login
- Sign in with
- Username or email, plus password
- Session
- 12 hours, or 30 days with “Keep me signed in”
- Two-factor
- Required for the Owner (admin) and Finance roles
Passwords
Every password must:
- be between 8 and 128 characters,
- contain at least one capital letter and one digit,
- not be on the list of common passwords (like
Password1).
Passwords are stored with argon2id, a slow one-way hash. Nobody, including Harbor staff, can read your password.
Two-factor sign-in
Anyone who holds the Owner (admin) or Finance role must use a six-digit code from an authenticator app (Google Authenticator, 1Password, Authy and similar) after their password.
Set it up
The first time you sign in with one of those roles, you are shown a QR code. Scan it with your authenticator app.Confirm
Type the six-digit code the app shows. From now on, each sign-in asks for a fresh code.
Two-factor for every other role, and passkeys, are on the Roadmap. The Security screen shows which staff who need it still have not set it up.
Invitations
An admin invites people from Users. The invited person gets an email
with a link to /app/invite/….
- The link works for 7 days.
- Opening it asks the person to choose their password. They are then signed in.
- If it expires, the admin sends a new one from the Users screen.
Forgotten password
Ask for a link
On the sign-in page choose Forgot password, and type your username or email.Open the email
The reset link works for 60 minutes and only once.Choose a new password
The same password rules apply.
The page always says the same thing whether or not the account exists, so it cannot be used to find out who works at your company. Reset emails are limited to 3 per account and 20 per network address per hour.
Lockouts
To stop password guessing, sign-in pauses for 15 minutes:
| After | Locked |
|---|---|
| 5 failed attempts on one account | That account |
| 20 failed attempts from one network address | That address |
Every refused sign-in is recorded. Repeated failures show up as alerts on the Security screen.
Signing out
Use the menu under your name, top right, and choose Sign out. Closing the browser does not sign you out if you chose "Keep me signed in".