Login & Authentication

Implemented

Last Updated: 2026-06-13

# Overview

BATbern uses a single unified login for all roles. Every account authenticates through the same screen, and the platform routes you to the right experience based on your role(s). There is no longer a separate login per role.

You can sign in with either of two methods:

Both methods work for all roles — Organizer, Speaker, Partner, Attendee, and Admin. The role(s) attached to your account determine what you see after login, not which method you used to sign in.

Apple / generic OIDC SSO is the only authentication method not yet available — it is planned but not released. Planned

All Cognito flows (login, password reset, email verification) and Google SSO are fully implemented and live.

# One Session for All Your Roles

If your account holds more than one role (for example you are both an Organizer and a Speaker), you log in once and get a single session. The navigation groups the features for each of your roles under section dividers — you no longer log out and back in to switch “hats”. See Dashboard Navigation for how the grouped navigation looks.

# Logging In

# Standard Login Flow

# First-Time Login

If this is your first time logging in, you may need to:

1. Verify your email - Check your inbox for a verification code
2. Complete your profile - Add your name and preferences
3. Accept terms - Review and accept the platform terms of use

# Continue with Google (SSO)

Implemented

Instead of an email/password, you can sign in with your Google account. This federated login is live for all roles and is provided through BATbern’s hosted identity domain auth.batbern.ch.

# How It Works

Note: SSO is governed by a runtime kill-switch. In the rare event it is temporarily disabled, the email/password method remains fully available.

# Partner Login

Partners log in through the same unified screen — email/password or “Continue with Google”. After authentication, the platform detects the PARTNER role and routes to the Partner Portal (analytics, topic voting, meeting coordination).

Note: Partners see only their own company’s data. If you are expecting organizer-level access, contact an administrator to verify your role.

# Speaker Login

Implemented

Speakers log in through the same unified screen as everyone else — email/password or “Continue with Google”. The earlier email “magic link” auto-login was removed during the unified speaker workflow refactor (Epic 11); speakers now have a normal AWS Cognito account.

A speaker’s Cognito account is provisioned by the organizer workflow when the speaker reaches the READY state. The speaker then signs in (or uses “Continue with Google” if the email matches their Google account) and lands in the Speaker Portal, where they can accept/decline the invitation and submit presentation materials.

Migrating from magic links? If you previously used an emailed magic link, that flow no longer exists. Use your email/password or “Continue with Google” on the standard login screen. If you don’t yet have a password, use Forgot Password to set one, or sign in with Google.

# Forgot Password

Implemented

If you’ve forgotten your password, follow the password reset flow:

# Password Reset Troubleshooting

Code expired?

• Verification codes expire after 1 hour
• Request a new code by starting the forgot password flow again

Email not received?

• Check your spam/junk folder
• Verify you entered the correct email address
• Contact support if issue persists: info@batbern.ch

Password requirements not met?

• Ensure your password includes all required character types
• Avoid common passwords or dictionary words
• Don’t reuse recent passwords

# Session Management

# Session Duration

Your BATbern session:

• Lasts: 1 hour of inactivity
• Refreshes: Automatically with activity
• Expires: After 24 hours regardless of activity

# Staying Logged In

To avoid frequent re-authentication:

• ✅ Keep your browser tab open
• ✅ Interact with the platform regularly
• ✅ Save your work frequently (auto-saves where available)

# Logging Out

To log out manually:

1. Click your profile avatar in the top-right corner
2. Select “Logout” from the dropdown menu
3. You’ll be redirected to the login screen

Tip: Always log out when using shared computers.

# Multi-Factor Authentication (MFA)

Planned

Multi-factor authentication will be available in a future release, providing an additional layer of security beyond password authentication.

# Security Best Practices

# Password Management

✅ Do:

• Use a unique password for BATbern
• Use a password manager (e.g., 1Password, LastPass)
• Change your password if you suspect compromise
• Use the full allowed length (8+ characters)

❌ Don’t:

• Share your password with others
• Use the same password as other services
• Write down your password
• Use easily guessable passwords (e.g., “Password123!”)

# Account Security

• 🔒 Monitor account activity - Report suspicious logins immediately
• 🔒 Use secure networks - Avoid public Wi-Fi for sensitive operations
• 🔒 Keep software updated - Use the latest browser version
• 🔒 Log out on shared devices - Always log out on public computers

# Troubleshooting

# “Invalid username or password”

This error means:

• Your email or password is incorrect
• Your account may be disabled
• You may need to complete email verification

Solution: Use the “Forgot Password?” flow to reset your credentials, or contact support.

# “User is not confirmed”

This error means you haven’t verified your email address.

Solution:

1. Check your email for the verification link
2. Click the link to verify your account
3. Try logging in again

# “Password attempts exceeded”

This error means you’ve made too many failed login attempts.

Solution: Wait 15 minutes before trying again, or use the “Forgot Password?” flow.

# Session Expired

Your session expired due to inactivity.

Solution: Simply log in again. Your work should be auto-saved (where applicable).

# Related Topics

• Dashboard Navigation → - What you see after logging in
• User Management → - Managing user accounts and roles
• Speaker Portal → - Speaker Cognito authentication and self-service
• Partner Portal → - Partner login and portal capabilities
• Troubleshooting Authentication → - Detailed troubleshooting guide

# API Access (Advanced)

Implemented

Developers and automation tools can authenticate programmatically:

# Get authentication token for API access
./scripts/auth/get-token.sh staging your-email@example.com your-password

# Token is saved to: /tmp/batbern-auth-token.txt
# Use in API requests: Authorization: Bearer <token>

See the API Documentation for details on programmatic access.