Sign-in and password problems

"Incorrect email or password"

That message is deliberately identical whether the address exists or not, so nobody can use
the login form to find out who has an account. Which means it does not tell you which half
was wrong. Check, in this order: the address you signed up with (emails are matched
case-insensitively, so capitalisation is never the problem), then the keyboard — a phone
that autocapitalises the first letter of a password is the single most common cause of this
one. Then use Forgot password? on the login page.

Forgot password: what the link does

Enter the address on /forgot-password and Clavoz emails a reset link if that address has
an active account — the page answers the same either way, again on purpose. The link:

• expires in 30 minutes — an old one reports "That reset link has expired (links last
  30 minutes)";
• works once — after the password is changed, the same link is spent;
• signs out every other session. Changing the password invalidates the sign-ins that
  were made with the old one, which is the point: if you reset because somebody else had
  your password, they are out.

If the email does not arrive, see Email Problems. If
you are locked out entirely and cannot receive mail at that address, email
hello@clavoz.com from another address and say what happened — a human can help, and
that is also the route for a Google-only account.

Password rules

At least 8 characters, up to 512. That is the whole policy — no symbol-and-number
theatre, because a passphrase you can remember and type on a phone in the field is worth
more than Passw0rd!. The rules are shown under the field while you type, and the same
rules apply on the reset screen and the register page.

Logged out in the middle of work

Sessions run on a signed token in the browser; when it expires or the account is no longer
allowed, the next request comes back unauthorised and the app sends you to the login page.
Two things cause this that are worth knowing:

• A password reset (by you or an admin) ends old sessions. So does deactivating a user.
• A closed or past-due workspace is refused at the gate, not by a page that looks
  broken: the workspace has been locked
  (Cancelling, and What Happens to Your Data).

Unsaved work in the quote builder lives in the browser until you save, so save before
stepping away on a big quote. If you are logged out with unsaved lines on screen, do not
reload until you have checked whether they saved — the browser's back button is often the
only copy left.

"Account disabled"

Deliberate, and it is a hard stop: no session is issued at all. A disabled account is what a
workspace owner (or Clavoz staff) sets when someone leaves the company. If you believe it is
a mistake, contact the owner of your workspace — only they can reverse it — or
hello@clavoz.com if you are the owner.

Google sign-in problems

• No Google button at all? Google sign-in is a server-side setting. If the button is
  missing, it is not configured for this deployment; sign in with an email and password
  instead.
• "Google email is not verified." Google reports the address as unverified, and Clavoz
  will not create a login on an address its owner has not proved.
• You signed up with Google and have no password. You are not stuck: use Forgot
  password? with that same address to set a password for the first time.
• "Google sign-in failed." Usually a blocked third-party popup or an expired Google
  session. Allow popups for the site (or sign in to Google in the same browser first) and
  try again.