Your account — sign in, password, 2FA
Manage your Certivant account login, password reset, email verification, two-factor authentication, passkeys, and active sessions.
What it does
This page covers the authentication flow for you, the tenant user — not the applicants you verify. It's everything you might bump into when signing in, recovering your password, or hardening your account.
If you administer applicant authentication (the public KYC hosted-flow OTP), see The applicant experience.
Signing in
Open the login page. You'll see whatever providers your platform's super admin has enabled — typically:
- Email + password — the default.
- Sign in with Google / Microsoft / GitHub — if social login is on.
- SAML / OIDC SSO — if your org has configured enterprise SSO under Settings → Identity & SSO.
If your org requires SSO and you're not its owner, the email-password form is hidden — pick the SSO button.
What can go wrong
- Email + password fail. Try the password reset flow.
- SSO blanket-redirects back to login. Your IdP isn't returning a recognised email. Ask your org admin to check your invitation matches your IdP email.
- "Account not found" even though you remember signing up. Make sure you're on the right Certivant deployment — some companies run multiple. Check the URL.
Signing up
If signups are open on your platform (super-admin-controlled), the Sign up link on login takes you to a registration form. Enter name, email, password. We send you a confirmation email; click the link to verify your address.
After that you land in the organization picker:
- If you came through an invitation link, you're auto-added to the inviter's organization.
- Otherwise you're prompted to create your first organization. See Your first organization.
What can go wrong
- Signups disabled on this platform — you can't self-register. Ask someone with an existing org to invite you.
- Confirmation email never arrives — check spam. If still missing, the dev/super-admin can re-issue.
Password reset
Forgot your password:
Click Forgot password? on the login page.
Enter your email. We send a one-time reset link.
Click the link (good for 1 hour). You're brought to a new-password form.
Set a new password meeting the policy (typically at least 12 characters, mixed case, a number — your super admin may have tightened this).
Sign in with the new password.
What can go wrong
- Link expired. Reset links expire in 1 hour. Request a fresh one.
- "This email is not registered." Either you typed it wrong or you never had an account on this Certivant. Re-check the URL — you might be on the wrong deployment.
Email verification
When you first sign up, we send a verification email. Click the link to confirm the address. If the link expires before you click (24-hour window), you'll see a page that lets you re-send.
Until you verify, some features are read-only — invitations you receive can't be accepted, billing changes are blocked.
What can go wrong
- Email never arrived. Spam. Re-send. If still nothing, ask your super admin to test the platform's email provider.
- "This verification link has expired." The fresh-link page has an inline form — type your email, click Send, you get a new 24-hour link.
Two-factor authentication (2FA)
We strongly recommend turning 2FA on for any account with admin or owner privileges. Setup:
Click your avatar (top-left of the dashboard) → Account settings → Security.
Click Enable two-factor authentication.
Scan the QR code with an authenticator app (Authy, 1Password, Google Authenticator, Bitwarden, your password manager of choice).
Enter the 6-digit code the app generates to confirm enrolment.
Download or copy your backup codes. These let you sign in if you lose access to your authenticator app. Store them somewhere safe — a password manager is ideal.
After enrolment, every sign-in asks for both your password AND the current 6-digit code.
Recovering when you lose your authenticator
Use one of the backup codes you saved during enrolment. The code is consumed (one-time use) and you should immediately re-enrol the authenticator and generate fresh backup codes.
If you have no backup codes and no authenticator, your only recovery path is to contact your org owner — they can ask the super admin to disable 2FA on your account. After regaining access, re-enrol immediately.
Passkeys
If your platform's super admin has enabled passkeys, you can register a hardware key or platform passkey (Touch ID, Windows Hello, YubiKey) for passwordless sign-in.
Setup is under Account settings → Security → Passkeys → Register passkey. Follow the OS prompts. Multiple passkeys per account — register one on each device you use.
Signing out
User menu (avatar bottom-left) → Logout. Signs you out of this session. Sessions on other devices are not affected unless you also revoke them under Account settings → Security → Active sessions.
Active sessions
Account settings → Security → Active sessions shows every device currently signed in to your account. Each session lists:
- Device + browser.
- Approximate location (from IP geolocation).
- Last activity timestamp.
- Revoke button.
Revoke any session you don't recognise. If you see one you can't explain, also change your password and re-enrol 2FA — it could mean a credential was leaked.
Troubleshooting
Login form rejects the right password
Try the password reset flow — sometimes it's the only way past a stuck cached credential. If reset doesn't help, the account may be locked due to too many failed attempts. Contact your org admin or super admin to unlock.
Stuck in a redirect loop after SSO
Your SSO configuration is probably mid-broken. Sign in with email-password instead (org owner always has this fallback, even with Require-SSO on). Then fix the SSO config under Identity & SSO.
"Your account has been impersonated by a super admin"
Your super admin is signed in as you for troubleshooting. The banner at the top of the page tells you so. The session ends when they click Stop impersonating — usually within minutes. Nothing to worry about; if you didn't ask for support and don't know why this happened, ask your team.
Related
- Roles at a glance — what your role can do.
- Identity & SSO — enterprise sign-in for your whole org.
- Invite teammates — extend the same auth flow to your team.
Danger zone
Permanently delete your Certivant organization — understand what data is removed, compliance considerations, recovery limits, and safer alternatives before proceeding.
Reference
Quick-lookup tables, glossaries, and FAQs for Certivant — roles and permissions matrix, email template variables, and answers to common questions.