Logging in

The app supports two authentication methods, and the login page chooses between them based on what kind of account the email belongs to:

• Organisation users (people at production companies) sign in with their email and a password.
• Contributors (people taking surveys) sign in with their email and a one-time code sent to their email — no password needed.

The login page handles both with a single form that reveals additional fields after the user enters their email.

What happens

sequenceDiagram
    actor User
    participant App as Your app
    participant Ory as Identity system

    User->>App: Open /login
    App-->>User: Email field, "Continue" button
    User->>App: Submit email
    App->>Ory: Look up what auth methods are available
    alt user is an org user
        App-->>User: Password field appears
        User->>App: Submit password
        App->>Ory: Sign in
    else user is a contributor
        App-->>User: Code field appears
        Ory->>User: Email with 6-digit one-time code
        User->>App: Submit code
        App->>Ory: Verify code
    end
    Ory-->>App: Session created
    App-->>User: Redirect to home (org users → projects, contributors → profile)

Step-by-step

Step 1 — Enter email

The page opens with a single email field and a “Continue” button.

Visible text	Translation key
Email label	auth.common.email-address
Continue button	auth.Login.continue
”Don’t have an account?” link	auth.Login.dont-have-account

When the user submits, the app asks the identity system what auth methods are available for that email. The page then reveals the next step based on the answer.

Step 2a — (Org user) Enter password

If the email belongs to an organisation user, a password field appears. The email stays visible but becomes non-editable; a “Use different email” link lets the user start over.

Visible text	Translation key
Password label	auth.Login.password
Sign-in button	auth.common.login
”Forgot password?” link	auth.Login.forgot-password
”Use different email” link	auth.Login.different-email

Wrong password produces an error from the identity system, mapped to translations under auth.errors.*.

Step 2b — (Contributor) Enter one-time code

If the email belongs to a contributor, a code field appears. The identity system sends a 6-digit code to the email. The user enters it.

Visible text	Translation key
Title	auth.Login.enter-code
Submit button	auth.Login.submit-code
”Resend code” link	auth.Login.resend-code (60-second cooldown)
“Use different email” link	auth.Login.different-email
Resend success toast	auth.Login.resend-code-success

After 5 failed attempts, the user has to restart by re-entering their email.

Step 3 — Land on the right place

Successful sign-in redirects:

• Organisation user → the projects list (the home page for producers)
• Contributor → their profile page
• Anyone arriving from a deep link (e.g. an invitation flow) → the deep link destination
• Orphaned account (a user with no company associations yet) → the “Complete profile” page so they can join or create a company

What you can customise

Translations

All login UI lives under the auth.Login and auth.common namespaces in tep-configuration/translations/{locale}/main/auth.json. Error messages (wrong password, expired code, etc.) live under auth.errors.*. Override per client in clients/{client}/translations/{locale}/overrides.json.

The one-time code email and the login experience

The 6-digit code email is sent by the identity system (Ory), not by your app. Its template, branding, and language are configured in your Ory project — separately from your tep-configuration translations.

Known gap

A password validation error (“Password must be at most 256 characters”) is currently shown only in English. It’s unlikely to appear in practice since the field caps at 256 characters in the UI, but it’s not localisable today.

Variations for your deployment

Your deployment	What’s different
Mock-auth mode (used in development, never in production)	Skips the identity system entirely; the password field appears immediately on the first step. Not relevant for customer deployments.
Diamond Code enabled	No effect on login itself; the code only shows up after a contributor submits a survey, on the sign-out page.
Single-method-only Ory configuration	If your Ory project is configured for only one auth method (e.g. password only, no contributor OTP flow), only that path will work.

Need more detail?

For code paths, the multi-step state machine, and engineering notes, see Logging in (engineering).