Sign-in Problems and Account Lockout

Sign-in is protected by failed-attempt tracking, a temporary account lockout and — for enrolled accounts — a two-factor code. This article explains each message you might see at /auth/login, how long a lockout lasts, and what you can and cannot do to speed things up.

The Sign-In Screen

The form has two fields, Email Address and Password, and a Sign In button. Below the fields is a Forgot password? link, and at the bottom “Don't have an account? Sign up”. The password field will not submit with fewer than six characters — you will see “Password must be at least 6 characters” before the request is even sent.

Wrong Email or Wrong Password

Both cases produce the same message: Invalid email or password. This is deliberate — it stops anyone using the login form to work out which email addresses have accounts. If you are sure the password is right, check that you are using the correct email address, that Caps Lock is off, and that your browser has not auto-filled an old password.

Failed Attempts and Lockout

TravelFlow counts failed sign-in attempts against your email address on the network they come from (your office or home internet connection, or your phone network). The numbers below are the built-in thresholds; they apply until a super admin saves other values in the Login Security settings, and every such save is recorded in the audit log.

• 5 failed attempts within 60 minutes from one network lock sign-in to the account from that network.
• A lockout lasts 15 minutes. While it is in force, every attempt is rejected before your password is even checked, with the message “Account is temporarily locked. Please try again in N minute(s).” When the wait left is not stated, the message reads “Account is temporarily locked. Please try again later.” instead.
• One successful sign-in clears that network’s counter completely.
• If 60 minutes pass with no attempts at all, the counter resets on its own and you start again with the full number of attempts.

Switching browser or device on the same network does not reset the count. Failures from a different network do not count here, so someone else guessing at your address from elsewhere cannot lock you out of your own connection. There is also a request rate limit — 30 sign-in checks per minute from one IP address and 15 per minute for one email address — which can trip if a script or a stuck browser tab is retrying in the background.

Other Blocking Messages

• Too many attempts. Please wait a moment and try again. — the authentication provider's own throttling, separate from the lockout above. Wait a few minutes before trying again.
• This account has been disabled. Please contact support. — the account itself has been switched off. Only an administrator can re-enable it.
• Please enter a valid email address. — the address is malformed.
• Network error. Please check your connection and try again. — the browser could not reach the service.

Signed In, But Not Where You Expected

Two situations let you past the password but not to your dashboard:

• A password change is required. If an administrator flagged your account for a password change, you are taken to the change-password screen instead of your dashboard. Setting the new password there signs out your other devices.
• Organization Inactive. If your organisation has been deactivated you land on a page reading “Your organization has been temporarily deactivated by an administrator”, with a Contact Support link and a sign-out button. Only an administrator can reactivate the organisation.

The Two-Factor Prompt

If your account is enrolled in two-factor authentication, a Two-Factor Authentication dialog appears after your password is accepted. It first prepares a security check (“Preparing security verification...”) and then sends a code.

1. A six-digit code is sent by SMS to your registered phone, shown as a masked hint such as the last digits of the number.
2. Type the code into the Verification Code box. The Verify button only becomes active once six digits are entered.
3. The dialog shows how long the code remains valid (“Code valid for 4:32”); codes last five minutes. Below two minutes you also get a “Session expires in Ns. Please verify soon” warning.
4. Resend code becomes available after a 60-second countdown (“Resend code in 42s” until then).

If you also have an authenticator app enrolled, the dialog defaults to it, the button reads Verify with App, and a Use SMS Instead button lets you switch. Going the other way, if the SMS does not arrive, a Use Authenticator App Instead button appears once the resend countdown expires — but only if you actually have an authenticator factor enrolled.

A wrong code gives “Invalid verification code. Please try again.” Wrong codes are counted, and once you are down to two tries or fewer an amber banner adds “Warning: N verification attempts remaining before lockout.” Repeated attempts in quick succession can also trip the provider's own throttling, shown as “Too many failed attempts. Please try again later.” An expired code gives “Verification code has expired. Please request a new one.”

Closing or Skipping the Two-Factor Prompt

The dialog has a close (×) button, and pressing Escape or clicking the dark background behind it also closes it. Doing so cancels the sign-in and signs you out — your two-factor settings are untouched and you can simply sign in again.

If your phone is genuinely unreachable, contact a super admin rather than skipping. They can remove two-factor from your account deliberately and help you re-enrol on a new number.

The security check can be blocked by ad blockers or by an unrecognised hostname, which produces messages such as “Security verification is blocked. Please disable ad blockers or try a different browser” or “Security verification timed out. Please refresh the page and try again.” Refreshing the page, or trying in a browser without extensions, usually clears it.

Resetting Your Password

1. Click Forgot password? on the sign-in screen, or go to /auth/forgot-password.
2. Enter your email address and click Send Reset Instructions.
3. You see Check Your Email — “If an account exists for your address, we've sent password reset instructions to that email address.” — whether or not the address is registered. That is intentional and does not confirm the account exists. If the request is refused instead, the form says why: after five requests from you, or five from you for the same address, within 15 minutes it reads “Too many requests for a new password. Try again in a few minutes.”, and where password reset e-mails are not set up it says “Password reset by e-mail is not set up on this server. Ask your administrator to reset your password.” If someone else asks too often for your address, they are the one told to wait, not you, unless they are on the same network as you, such as an office network or, sometimes, the same mobile network: requests from one network count together. A request from a browser where you signed in to TravelFlow with that address in the last 90 days gets its e-mail, up to ten an hour from that browser, whether or not you signed out afterwards, as long as your address is confirmed and neither a password change nor an administrator has signed you out everywhere since; if several people sign in on one browser, only the last one counts. Other requests for your address, someone else's included, count towards at most ten reset e-mails an hour: past that you still see Check Your Email but no further e-mail is sent, so use the newest link you have, or try again after the hour.
4. The link in the email opens TravelFlow's own Choose a New Password page. It lists the password rules in force and checks your new password against them before anything is saved. Enter the password twice and click Set Password; the page then shows Your Password Is Set, and you sign in with the new password. The link works once and expires after an hour. If it has expired or was already used, the page says “This link has expired or was already used. Ask for a new one.” with an Ask for a New Link button; a link that was cut short says “This link is incomplete. Open the whole link from the e-mail, or ask for a new one.”
5. Use Try Another Email if you typed the wrong address, or Back to Sign In when you are done.

If the email does not arrive, check your spam folder first, then confirm with an administrator which address your account actually uses.

When to Raise a Support Ticket

• Your account is disabled, or your organisation shows as inactive.
• You have lost access to the phone used for two-factor codes.
• The reset email never arrives after two attempts and a spam-folder check.
• You are locked out repeatedly without having typed a wrong password, which can point at a saved credential retrying in the background.