Several different blocks can stop you signing in, and they look similar from the login screen. This article explains each one, how long it lasts, and who can clear it.
“Account is temporarily locked”
TravelFlow counts failed sign-in attempts per email address and network, so failures from somewhere else never lock you out of your own connection. The built-in rule is that 5 failed attempts within 60 minutes from one network lock sign-in from that network for 15 minutes. It applies until a super admin saves other values in the Login Security settings, on Admin > Settings > General Settings, and every such change is recorded in the audit log. The counter starts again once the attempt window has passed since the last failure. When the limit is reached the account is locked, and the login screen shows “Account is temporarily locked. Please try again in N minute(s).” with the wait that is left. When no wait is stated it shows “Account is temporarily locked. Please try again later.” instead.
The network’s counter is cleared by a successful sign-in, so once the lock lapses a correct password puts the account straight back to normal. Trying again during the lock does not extend it, but it does not help either — wait for the stated number of minutes.
If you are not sure of the password, use the forgot-password link instead of guessing, because each wrong guess counts towards the lock. Your organisation administrator (or, for consultants, the consultant admin) can unlock your sign-in on every network from the colleague panel on their Security page. A super admin can see the locked accounts under Locked Out Users in the same Login Security settings and unlock one straight away with its Unlock button. Every unlock is recorded in the audit log.
Forced or Expired Password Change
Two situations send you to the change-password screen immediately after you sign in, before you reach any dashboard: an administrator flagged your account as requiring a password change, or your password has passed the expiry age set in system settings. In the second case you also see “Your password has expired. Please set a new password.”
The new password must satisfy the password policy: at least the configured minimum length, and at least one uppercase letter, one lowercase letter and one number. Special characters may also be required. The form rejects a weak password with the specific rule it broke, for example “Password must contain at least one uppercase letter.”
“Organization Inactive”
If your organization has been switched off, sign-in succeeds but every page redirects to a screen titled Organization Inactive reading “Your organization has been temporarily deactivated by an administrator.” Only an administrator can reactivate the organization; nothing you change on your own account will restore access.
Multi-Factor Authentication Errors
Where MFA is enabled, the verification step has its own failure messages:
- “Security verification is blocked. Please disable ad blockers or try a different browser.” — a content blocker or strict privacy setting is stopping the security check from loading. Allow the site, or use another browser.
- “Verification code has expired. Please request a new one.” — codes are valid for five minutes. Request a fresh code; resends are throttled to one per minute.
- “Invalid verification code. Please try again.” — check the six digits. After a few wrong attempts you are warned how many remain, and at five failures verification is blocked with “Too many failed attempts. Please try again later.”
- “MFA session expired. Please start again.” — the verification step itself times out after five minutes. Close the dialog and sign in again.
If SMS codes never arrive, confirm the phone number on your account is in international format (for example +27 …). An administrator can remove your MFA enrolment from the MFA section of Admin > Settings > General Settings if the number is wrong or the device is lost, after which you enrol again on next sign-in.
Signed Out Unexpectedly
Being returned to the login screen mid-session is usually the idle timeout — 30 minutes of inactivity unless an administrator has set another limit, with a Session Expiring warning first (60 seconds by default) — or the 12-hour limit on every sign-in. A password change on another device, a deactivated account or a removed two-factor device also ends your sessions. See the Session Timeout article. Blocked browser storage can also cut sessions short; see Browser Requirements.