--- title: Signing in order: 2 updated: 2026-07-12 --- # Signing in Every user signs in with three pieces of information: a *Company ID*, a *Username*, and a *Password*. The *Company ID* identifies your firm (each firm has its own private data), and the *Username* identifies you inside that firm. Two firms can each have a user called `admin` — they never collide, because the *Company ID* keeps them apart. The same sign-in screen serves both the browser version and the desktop app. Everything on this page works identically in both, except where a difference is called out. ## Before you start - Get your *Company ID*, *Username*, and *Password* from whoever set up the app for your firm (usually your firm administrator). - Make sure you are on the correct sign-in page for your firm. If you are not sure of the address, ask your administrator. - If you will ever need to reset your own password, make sure an email address is saved on your account. Without one, self-service password reset is not possible — see [What if my account has no email?](#what-if-my-account-has-no-email). You (or an administrator) can add one under *Settings → Security → Change Email Id*. ## Open the sign-in page When you open the app without being signed in, the sign-in card appears automatically. It shows the *Intigra* logo (clicking the logo opens the Intigra website in a new tab), a short *Sign in to your account* heading, the three fields, a *Sign In* button, and two recovery links — *Forgot username?* and *Forgot password?*. ## Sign in 1. Type your firm's identifier into *Company ID* (for example `your-company`). 2. Type your *Username*. 3. Type your *Password*. 4. Press `Enter` while in the password box, or click *Sign In*. While the request is in flight the button reads *Signing in…* and the fields are disabled. If your details are correct, the app reloads and takes you to your dashboard. If anything is wrong, a message appears explaining what failed. All three fields are required. If you leave one blank, the field is flagged inline (`Company ID is required`, `Username is required`, `Password is required`) and nothing is sent. The server independently rejects any request that is missing a field, so this check cannot be bypassed. ### What each field means #### Company ID Your firm's short login handle — the same value your administrator uses. It is **not** case-forced on the sign-in screen, but the recovery flows lower-case it, so treat it as case-insensitive. Enter it exactly as your administrator gave it to you. #### Username Your personal username inside the firm. Usernames are unique within a firm but not across firms. The built-in firm administrator's username is `admin`. #### Password Your secret password, `8`–`16` characters. It is never shown as you type. Passwords are stored only as a secure hash — nobody, including support, can read your existing password; it can only be reset. ### Sign-in messages and what they mean The server verifies every part of your login independently. You may see: - *Missing credentials* — one of the three fields reached the server empty. - *Firm username not found* — no firm matches that *Company ID*. Check the *Company ID* spelling. - *This firm has been deactivated* — the firm's account has been removed. Contact your administrator. - *This firm is currently suspended. Contact the platform administrator.* — the firm is temporarily suspended at the platform level. - *Username or password is incorrect* — either the username does not exist **or** the password is wrong. The message is deliberately the same for both, so it never reveals whether a username exists. - *This account has been deactivated* — your user was removed by an administrator. - *Storage is full. Only the firm admin can log in until storage is freed.* — the firm has hit its storage limit; see [Why can only the admin log in?](#why-can-only-the-admin-log-in) below. ## Staying signed in A successful sign-in stores a secure sign-in cookie in your browser or app. The cookie is `HttpOnly` (JavaScript on the page cannot read it) and is kept for up to `90` days, while the underlying token itself is valid for `30` days. In practice: - Closing the tab or the app window and coming back later usually keeps you signed in. - You do not need to sign in again on every visit within the token's validity. - Signing in again from the same kind of device replaces the previous sign-in on that device (see below). ### One session per device type The app tracks two independent "slots" per user: a **desktop/browser** slot and a **mobile** slot. The web app and the desktop app both occupy the desktop/browser slot; the companion mobile app occupies the mobile slot. - You can be signed in on a computer **and** on your phone at the same time — those are different slots. - Signing in a **second time on the same slot** signs the first one out. For example, signing in on another computer (or in the desktop app while already signed in a browser) ends the earlier computer/browser session — that device is disconnected and its session removed. Your phone session is left untouched. This is why you may occasionally find yourself signed out: someone signed in to your account on another computer. If that was not you, change your password and tell your administrator. ### Desktop vs web - In the **desktop app**, sign-in also records the computer's hostname, the OS user, and the app version, so the session shows up with a recognisable name (for example `OFFICE-PC - riya · v1.1.69`) in your session list. - In the **browser**, the session is labelled from the browser and operating system instead. Everything else — the fields, the messages, and the recovery flows — is the same in both. ## Forgot your password? You can reset your own password from the sign-in page without waiting for an administrator. You will need access to the email address saved on your account. The whole flow runs on the sign-in screen and moves through three steps. 1. On the sign-in page, click *Forgot password?*. 2. **Request a code.** Enter your *Company ID* and *Username*, then click *Send code*. The app emails an `8`-digit verification code to the address on your account and shows that address partially masked so you can confirm it is the right inbox. 3. **Enter the code.** Open your inbox (check spam too) and type the `8`-digit code. Click *Verify code* — or the code auto-submits once all 8 digits are entered. 4. **Set a new password.** Choose a new password (`8`–`16` characters) and confirm it. Use *Show password* / *Hide password* to check what you typed. Click *Update password*. 5. Sign in with your new password. ### Things to know about the code - **The code expires after `5` minutes.** If it runs out, request a new one — you will be sent back to the start. - **You get `3` tries per code.** After 3 wrong entries the code is cancelled ("Too many incorrect attempts. Please request a new code.") and you must request a fresh one. Each wrong try tells you how many attempts remain. - **You can only request a new code once every `60` seconds.** The *Resend code* link shows a countdown ("Resend code in Ns") until it becomes clickable again. - **Only the most recent code works.** Requesting a new code invalidates any earlier one. - **Resetting your password signs you out of every device**, so sign back in afterwards with the new password. - To guard against abuse, reset requests are also limited to a handful per fifteen minutes from the same network; if you hit that, wait a little and try again. ### What if my account has no email? If your account has **no email address saved**, self-reset is not possible — the screen tells you *"No email is associated with this account. Please contact your administrator."* Your administrator can add an email or reset your password directly from *Settings → Users*. See [Users and permissions](/docs/settings/users-and-permissions). This is the one case where the reset screen tells you the account exists; every other outcome is deliberately vague so the screen never reveals which Company IDs or usernames are real. ## Forgot your username? If you remember the email on your account but not your *Company ID* or *Username*: 1. On the sign-in page, click *Forgot username?*. 2. Enter your email address and click *Send my details*. 3. If an account is linked to that email, the app emails your *Company ID* and *Username* to it. The same email can be attached to accounts in **more than one firm** — every match is listed in that email. A few details: - The email must be a valid address (and at most `254` characters); otherwise the field shows *"Enter a valid email address."*. - For privacy, the confirmation screen looks the **same whether or not a match was found** ("If an account is associated with … we've emailed the Company ID and username to it"). The message never reveals which emails have accounts. - If your firm's main firm email matches, that firm's login is returned with the username `admin` (firm administrators cannot rename themselves). - This lookup is deliberately rate-limited: a given email can only trigger the search once every `10` minutes, and there is an additional per-network cap. If nothing arrives, wait and check spam before retrying. ## Signing out Closing the browser or the desktop window does **not** sign you out on its own — your session stays valid until it expires or you sign out explicitly. To sign out, open *Settings* and go to the *Security* tab. At the bottom you have two buttons: - *Logout From Current Device* — ends only the session on the device you are using now (the computer/browser slot or the mobile slot, whichever made the request). Other devices stay signed in. A confirmation is shown first. - *Logout From All Devices* — ends **every** session for your user, including the one you are on. Use this if you think someone else has access. A confirmation is shown first. The same *Security* tab lists *All Logged In Sessions* with the device, operating system, IP address, and sign-in time. Your current session is marked *Current* and cannot be revoked from the list; any other session has a *Revoke* button to sign just that device out. See [Security](/docs/settings/security) for the full session-management, change-password, and change-email details. In the **desktop app**, the thin title bar at the top of the window also carries a small menu with theme and sign-out, so you do not have to open *Settings* to sign out. The web version does not show this title bar — use *Settings → Security* instead. See [Finding your way around](/docs/getting-started/navigating#the-desktop-title-bar). ## Changing your password while signed in You do not need the *Forgot password?* flow if you already know your current password. Open *Settings → Security → Change Password* and enter your *Current Password*, a *New Password* (`8`–`16` characters), and confirm it. The new password must be different from the current one. This is the same password policy the sign-in screen enforces. Full details are in [Security](/docs/settings/security). ## Common questions ### What if I forgot my password? Use *Forgot password?* on the sign-in page to reset it yourself with an emailed `8`-digit code (see [Forgot your password?](#forgot-your-password) above). If no email is saved on your account, ask your administrator to reset it from *Settings → Users*. ### Why was I signed out automatically? Either your session expired, or someone signed in to your account on another computer/browser (which ends the earlier one on that same device type). Resetting your password also ends every session. If you did not sign in elsewhere, change your password and tell your administrator. ### Can I be signed in on my computer and my phone at the same time? Yes. The computer/browser and the mobile app use separate session slots, so one of each can be active together. Signing in a second time on the **same** kind of device is what ends the earlier session. ### Can two people share one login? No. Each person should have their own user. Sharing a login makes it impossible to know who entered what, and the app will sign one of you out as soon as the other signs in on the same kind of device. Ask your administrator to create a user for each person — see [Users and permissions](/docs/settings/users-and-permissions). ### Why can only the admin log in? If your firm has used up its entire storage allowance, ordinary users are blocked from signing in and see *"Storage is full. Only the firm admin can log in until storage is freed."* Only the `admin` user can still sign in, so they can go in and free space or upgrade storage. See [Billing and storage](/docs/settings/billing). ### The Company ID or username is right but sign-in still fails — why? The message *Username or password is incorrect* covers both a wrong password and a username that does not exist — it is intentionally vague so it never confirms which usernames are real. Double-check the password (it is case-sensitive), and confirm the *Company ID* is spelled exactly as your administrator gave it. If the *Company ID* itself is wrong you would instead see *Firm username not found*. ### I never got my reset code or username email — what now? Give it a minute and check your spam folder. Codes and username emails go to the address on file, so if you have changed inboxes the mail may be going to an old one. Reset codes also expire after `5` minutes and can only be re-requested once a minute; the username lookup can only be re-run for the same email once every `10` minutes. If nothing ever arrives, your account may have no email saved — ask your administrator to check and update it. ### Do I need to install anything to sign in? No. The app runs in your browser, and your firm may also offer a desktop app. Both sign in the same way and connect to the same data, so you can use either. See [Welcome](/docs/getting-started/welcome) for the difference between the two.