Sign in Talk to us Start a trial
Start a trial

Design and software studio
Color

Customer account with a one-time sign-in code

Customers sign in at /my with a six-digit code sent to their email and see their vehicles, tow jobs, taxi trips, estimates, repair orders, invoices and receipts.

For
OwnerService advisorDispatcher
Hosting
Any hosting
Devices
All devices
Business
Repair shopTowingTaxi and livery

Checked against Pop Dispatch 0.1.0

Customers open /my on your server's public address, type the email address on their record and receive a six-digit code. No password is needed. After they type the code they see what your business holds under that email address and can open the status page of a repair or pay an open invoice.

Before you start #

  • Save your public base address in settings, so customers can reach /my from outside your office.
  • Fill in your office mail settings. The code travels by email. Without mail settings the message is held in your outbox and the customer receives nothing.
  • A customer needs an email address on their customer record, or on a taxi booking.

What the customer does #

  1. Opens /my, types their email address and chooses Send me a code.
  2. Reads the email, types the six digits and chooses Sign in.
  3. Sees one section for your business with Vehicles, Tow jobs, Taxi trips, Estimates, Repair orders, Invoices and Receipts. An invoice with a payment link shows Pay this invoice. A repair shows Follow this repair, which opens its status page.
  4. Chooses Sign out on a shared device. The sign-in lasts 7 days on a device otherwise.

What keeps it safe #

  • A code works once and for 10 minutes. Five wrong tries use the code up. Asking for a new code replaces the old one.
  • Each email address can ask for 3 codes and try 10 codes in 15 minutes. Each network address can ask for 10 codes and try 20 in 15 minutes. Past a limit the page asks the customer to wait.
  • The page answers the same way for every email address, so it never reveals whether an address is on file.
  • Every list is limited to records held under the signed-in email address in your business. Another customer's records never appear.
  • Only a hash of the code and of the sign-in cookie is stored. After an email is sent, the outbox keeps the message with the code hidden.
Technical details
  • Routes, no sign-in: GET /my, POST /my/code, POST /my/verify, POST /my/signout, POST /my/orders/:tenant/:id/status.
  • Tables: customer_login_codes, customer_sessions. The cookie psd_my is HttpOnly, SameSite Lax, and Secure behind HTTPS.
  • When the same email address is a customer of more than one business on a server, the page has one section for each.

If something goes wrong #

  • The customer gets no email: check the spam folder, then your office mail settings and the outbox.
  • "That code did not work": the code was typed wrongly five times, has expired or was already used. Ask for a new one.
  • "Too many tries": wait 15 minutes.
  • The lists look empty: the email address on the customer record may differ from the one typed. Correct the record.