Signing in

Who this is for: All users
What you'll achieve: Open your school portal and sign in with SSO or email and password

Before you begin

• Your school’s subdomain (for example demo or riverside)
• An invited account (email + temporary password from your admin)

Portal URL

Each school lives under a tenant path:

https://{your-host}/t/{subdomain}/login

Examples:

Environment	URL
Local demo	http://localhost:3001/t/demo/login
Production pattern	https://app.schoolrota.com/t/{subdomain}/login

Trusts with several schools

When a tenant has more than one school (for example after a trust signup), URLs include a school segment: /t/{subdomain}/sites/{siteCode}/login. Single-school tenants keep /t/{subdomain}/login; legacy URLs redirect to the default school. Use the School menu in the sidebar to switch school.

Steps

1. Open your school’s login URL.
2. If your school has SSO enabled, select Sign in with Microsoft (or Google/Okta).
3. Otherwise enter your email and password and select Sign in.
4. If this is a local-password owner, admin, or duty lead and you have not enrolled MFA yet, you see a first-step authenticator card. Scan the QR code, confirm a code, then Done. After that, new schools open the guided setup wizard.
5. Once MFA is on, later sign-ins ask for a six-digit authenticator code (or a backup code) after your password.
6. After the school is live, you land on your role’s home. My schedule for staff (personal timetable), Today for duty leads and office staff. Admins who still have setup unfinished stay in the wizard until they skip or go live.

Demo credentials (local only)

Field	Value
Email	admin@demo.school
Password	changeme123

Production

Never use demo passwords in production. Change temporary passwords after first login when your school process requires it.

Forgot your password?

On the sign-in page, choose Forgot password? and enter your email. If a local password account exists for that address, you will receive a reset link (valid for one hour). SSO-only accounts must sign in through your school provider.

Complete the reset

1. Open the link in the email - it goes to /t/{subdomain}/reset-password?token=....
2. Enter a new password and confirm it.
3. Select Reset password, then sign in with the new password.

If the link is missing, expired, or shows “invalid”, request a new reset from the sign-in page. In production, email delivery requires a real provider (EMAIL_PROVIDER=resend with RESEND_API_KEY) - local dev logs emails to the console instead.

Sign out

During first-run setup, select Sign out in the top header.

Once the full portal is open:

1. Open the sidebar (on a phone, tap Menu).
2. Select Sign out at the bottom of the list.

You can also sign out from Account, or from Admin if that page is available for your role.

Current limitations

• SAML IdPs are not supported yet: use OIDC (Entra, Okta, Google). See SSO setup or the IdP pilot runbooks.
• MFA (local password accounts): owners, admins, and duty leads enrol an authenticator on first sign-in, then enter a code on later visits. Office users may enrol later from Account. SSO accounts use MFA at your identity provider.

Troubleshooting

Problem	What to try
Wrong school	Check the {subdomain} segment in the URL
Invalid credentials	Confirm email spelling and temporary password with your admin
Redirected back to login	Session expired: sign in again
Reset link invalid or expired	Links last one hour; request a new reset from Forgot password?
No reset email in production	Confirm admin set EMAIL_PROVIDER=resend and staff email is correct

What happens next

• Navigating the portal
• Roles and permissions