The sign-in page has Home, Terms, Privacy, Cookies, and Contact links at the bottom right. Use them to open the public website in the same tab without signing in. These links also appear on the dashboard's central sign-in screen after sign-out or a sign-in error. Contact opens the public contact page; it does not open a support ticket.

Account services are not available yet

If this message appears, registration, sign-in, and dashboard access are not available from the public website. It also applies to invitation acceptance, password reset, provider sign-in callbacks, and account-deletion links. This is an availability limit for all roles and plans; changing your password or plan does not remove it.

Select Contact us for help or Return to home to keep browsing. Public features, pricing, Help, and Contact pages remain available without an account. Keep any invitation or recovery email private. If a link has a deadline, contact support before it expires; this message does not extend the deadline. Do not include the full link or its token in your enquiry.

Too many attempts or temporary unavailability

If an account form says Too many attempts. Please try again later., stop submitting and wait before trying again. This can affect sign-in, registration, password recovery, reset links, and invitation acceptance. Limits can also apply to people who share a network. Changing plans or the capitalisation of an email address does not remove the limit.

If sign-in says Too many sign-in attempts. Wait, or reset your password to sign in., wait or use Forgot password. Password recovery has its own limits, so check for an existing reset email before requesting another.

If the service says Authentication is temporarily unavailable. Please try again., wait and retry later. Contact support if the problem continues. A blocked attempt does not confirm whether an account exists or whether an email was sent.

Create an account

Open Register.
Enter the requested name, email address, and password. Follow the password validation shown on the form.
Read the account setup notice and select an available offer. Where Pay as you go is on sale, it is selected first and there is no Free plan: your first site is free, and you verify a card before adding more sites. An old link to the Free plan (?plan=free), or a link to a plan that is not offered, opens the form with Pay as you go selected. Only where billing or Pay as you go is switched off does the form offer Account setup, which needs no payment details. For Pay as you go and Agency, choose a Billing currency (AUD or USD; EUR only for an Agency EUR link). Sentinel picks the starting currency in this order: your choice on the page, the link you followed, the currency saved on the pricing page, your region, then AUD. Changing the currency unticks the Terms checkbox, so tick it again. Account setup starts no subscription. In an enabled test environment, monthly PAYG asks for USD or AUD; Agency offers its configured currency and billing period. Both require card verification after organisation setup. Retired Solo and Studio plans and new PAYG annual/EUR offers are not offered. A saved link cannot enable an unavailable offer. If the form says Signup options could not be loaded. Reload the page to try again., Create Account stays disabled; reload the page. See Current account setup limits.
If you have a voucher code, select Have a voucher code? and enter it in Voucher code. A link ending in ?code= fills the field and opens it for you. The code is checked when you create your account; if it cannot be used, the form shows why on that field and you can correct it or clear it. Nothing is held for you until you confirm your email address. A Black membership code is used when you confirm it; if it can no longer be used by then (for example, it has been fully used), your account is created without Black. You then get a message, Your signup voucher code was not applied, with the reason, and the voucher panel on Billing shows the same note until you check another code there. Nothing is charged; contact support if you expected Black. A discount code is kept and filled in on the review step of your first paid site. Where Pay as you go is not on sale, every code is refused as not valid; clear the field to create your account.
Read and accept the Terms.
Submit the form. If automatic sign-in does not complete, use Sign in.
Complete the required organisation step and any selected card step, then add a site if permitted or select Skip for now. New account setup does not require the older package checkout.

If registration shows Internal server error, wait and try again later. If the next attempt says the email address already has an account, use Sign in. If the error continues, use Contact and include the time and error text. Do not include your password.

If Agency registration reports temporary billing unavailability, wait and retry the same selection. The server checks that configured package before creating the account; an unavailable provider or missing price does not start a purchase or create a partial signup.

Email addresses are matched without case differences and with spaces at either end removed. Use your existing account instead of registering again with different capitalisation.

Google and GitHub sign-in are available only when the provider is enabled. Use the provider button and finish its sign-in steps. If Sentinel asks you to accept updated Terms, complete that step before entering the dashboard.

Confirm your email address

A new password account must confirm its email address before it adds its first site. Registration sends a confirmation email to the address you entered. You can sign in, create your organisation, and use the rest of your account before you confirm.

Check Email to confirm in the message before opening its link. It shows the exact address being confirmed, including any + suffix.

Open the link in the confirmation email.
Select Confirm my email address. Opening the link alone does not confirm anything.
Return to the setup page or the Add site dialog and select I have confirmed, check again. The page also checks on its own.

The link works once, expires after a limited time, and does not sign you in. Only the most recent link works. If the page says This link has expired, This link does not work, or A newer link replaced this one, use Email me a new link on that page, or Send a new link while signed in. Requests are limited; when a button shows a countdown, wait until it ends. A request for a new link does not confirm whether an account exists, and an existing link stays valid if no new email is sent.

While you wait, the confirmation step shows whether the email is still waiting to be sent, was accepted by our email provider, could not be sent, or has an unknown result. Accepted by the provider does not mean it reached your inbox; check junk mail. If sending failed, send a new link. If the step says We could not check your email confirmation, select Try again; the site form stays closed until the check succeeds.

Accepting an invitation sent to your address counts as confirmation. Signing in with an account already linked to Google counts if Google confirms the same email address. A password reset does not confirm the address. A new password account that changes its address before adding its first site must confirm the new address. Accounts created before this step was introduced keep their access. After the account has added a site, this step does not apply again. If adding a site says your account is busy, wait briefly and try again.

Accept an invitation

The invitation email shows Organisation and Invitation email. Check both before accepting, especially if several addresses arrive in the same inbox.

Open the link from the invitation email.
For a new account, enter your name and a password. For an existing account, use its current password.
Accept the Terms and select Accept Invitation.
If the existing account uses two-factor authentication, the page then asks for a code. Enter a code from your authenticator app or an unused recovery code. If phone codes are on, you can ask for a WhatsApp or SMS code instead. Select Back to return to the password step.
Sign in and select the organisation you joined.

For an existing account, password attempts on the invitation page share a limit with normal sign-in. Repeated attempts on either page can temporarily block the other. Wait before retrying. A blocked acceptance leaves the invitation pending with its original expiry; it does not use or replace the link.

An existing account with two-factor authentication gives its password first, then a code, before it joins the organisation or accepts the Terms. A wrong code leaves the invitation pending. It counts toward the same lockout as sign-in: five wrong codes, of any method, pause both the invitation page and sign-in for 15 minutes, and the page shows the same pause. If the acceptance fails for another reason, a code from your app or a recovery code is not used up, but a WhatsApp or SMS code is, so ask for a new one. New accounts and accounts without two-factor see no extra step.

If your organisation or the platform requires two-factor authentication and you have not set it up, the page asks you to sign in, set up two-factor authentication, and then open the invitation link again. The link stays valid until it expires.

The invitation page also supports Google when enabled. Use the Google account with the email address that received the invitation. An account linked to Google accepts with Google alone, as in Google sign-in, with no Sentinel code. Follow that page's available sign-in choices; a GitHub button on the normal sign-in page does not establish an invitation acceptance flow.

If the link is invalid, expired, or cancelled, ask an administrator to resend the invitation. If you have an existing account and cannot remember its password, reset it first. Do not create a second account to bypass an invitation error. If acceptance is refused because the billing account is full, ask its administrator to review the shared capacity and unused invitations. Password and Google acceptance use the same capacity check. If the account is busy, wait briefly and retry the same link; a refused attempt does not accept the invitation.

The service decides whether the dashboard signs you in on its own page or through a central sign-in page. You and your organisation cannot change this. If your dashboard uses the central sign-in page, opening Sign in or any dashboard page without a session takes you there in the same tab.

Sign in as usual with your email address and password, Sign in with Google, or Sign in with GitHub. The same Terms, two-factor and password expiry steps apply.
After sign-in, the dashboard opens the page you started from.

The dashboard does not keep your sign-in in the browser tab. When you reload the page or open the dashboard again, it signs you in again without showing a page, as long as your central sign-in is still active. While you keep using the dashboard, your sign-in renews for up to 12 hours by default. After that, sign in again. The 30-minute inactivity sign-out described under Password recovery and sessions still applies. Registration still signs a new account in directly; when that session ends, you sign in through the central sign-in page.

Sign out in the account menu also ends your central sign-in. You then return to the dashboard sign-in screen, which says why:

You are signed out. after you select Sign out.
Your session has expired. Sign in again to continue. after the inactivity sign-out.

Select Sign in to sign in again, or Sign in with GitHub or Sign in with Google to go straight to that provider. These buttons appear only when the provider is enabled.

If sign-in cannot finish, the page shows a message and a Sign in again button. For example, Sign-in was cancelled. You can sign in again. appears when you cancel. This sign-in has expired or was started in another tab. Sign in again. appears when the sign-in took too long or you started it in another tab. Select Sign in again to start a new sign-in. Sensitive actions still ask for a fresh two-factor code, and your selected organisation works as before.

Password recovery and sessions

Open Forgot password, enter your email address, and use the reset link sent to your mailbox. Set and confirm a new password. If the page says Invalid or Expired Link, select Request new reset link. Check junk mail if the message does not arrive.

The reset email identifies the account under Sign-in email. Password-change, two-factor reset and related account-security notices also show this address. Check it before acting; your display name alone may not distinguish accounts.

Check your inbox and junk folder before requesting another reset email. Recovery requests for the same address must be at least 30 minutes apart, and other attempt limits can require a longer wait. A request blocked by a limit does not replace an existing reset link. Reset links expire after 30 minutes and can be used once. A recovery confirmation does not confirm that the address has an account or that the message reached its inbox.

If the page says Could not check this link, keep the page open and use Try again. When the button shows Try again in … seconds, wait until it becomes available. This checks the same link after a temporary limit or connection problem; it does not request another email. The link can still expire while you wait. After a successful check, enter and confirm your new password.

After a successful reset, stay in the same browser tab and on the same network. Sign in with the new password within five minutes. This gives you one sign-in attempt even if the account's ordinary sign-in attempt limit is still in effect. Check the address and password before submitting. Network limits still apply, and you must complete any required two-factor and Terms steps.

If sign-in says Your password reset sign-in permission is invalid or expired, check your email address and new password, then submit sign-in again. This manual retry uses normal sign-in and can succeed if its limits allow it. If sign-in remains blocked, use Forgot password to request another reset when recovery limits allow it. The message concerns the temporary recovery permission; it does not confirm that your new password is wrong. Sign-in does not retry automatically.

Refreshing or closing the page loses this one-attempt recovery option. An unsuccessful attempt uses it too. You can still use normal sign-in once its limits allow it; losing the option does not undo your password change.

Password recovery also removes existing social sign-in links. Sign in with the new password, then link Google or GitHub again from Profile if needed.

How long a session lasts. When you sign in on the dashboard's own page, with your password, Google or GitHub, Sentinel renews your session in the background while the dashboard is open, so you are not signed out in the middle of your work. Two limits apply, and your operator sets both (the figures below are the defaults):

Inactivity: 120 minutes. After 120 minutes without activity, such as clicking, typing, scrolling or touching the screen, you are signed out. Sixty seconds before that, a warning says You will be signed out in N seconds and Sessions end after 120 minutes without activity. Select Stay signed in to keep going. Clicking elsewhere or typing once the warning shows does not keep the session. If you do nothing, you return to the sign-in screen with You were signed out after 120 minutes without activity.
Longest session: 8 hours. However active you are, a session ends 8 hours after you signed in and is not renewed past that point. When it ends, the dashboard sends you to sign in again with Your session reached its time limit. Please sign in again. Save your work before a long session reaches this limit.

Sign out everywhere ends your sessions at once, and they cannot be renewed. If your dashboard uses the central sign-in page (see the section above), a 30 minute inactivity sign-out applies instead, and the central sign-in sets the longest session. Use Sign out in the account menu when you finish.

Password expiry

Every account that has a password must change it every 90, 180 or 365 days, depending on the period that applies. The platform default is 365 days, which is also the longest period allowed. An organisation administrator can choose a shorter or equal period for their organisation. If you belong to several organisations, the shortest period applies to you. Accounts that sign in only with Google or GitHub and have no Sentinel password are not affected until they add a password. API keys and Drupal site connectors are not affected.

Sentinel emails you 14 days before, 3 days before, and on the day your password expires, once each. The subject reads Your Sentinel password expires in N days or Your Sentinel password has expired. Select Change your password in the email to open Profile. Accounts that existed before this rule started have at least 30 days before their first expiry.

Profile shows Password last changed with the date and how long is left, for example "expires in 20 days", under Change Password. An Expiring soon badge appears within 14 days of expiry and an Expired badge once it has passed. Accounts without a password do not show this line.

When your password has expired at sign-in, Sentinel checks your password, Terms and any two-factor code first. It then opens Change your password with "Your password has expired and must be changed." instead of starting a session. If a session is already open when the password expires, the next refused request sends you to the same page with "Your password is older than N days and must be changed." and a Sign out button. At sign-in the page does not state the number of days.

Enter your Current password, a New password and Confirm new password, then select Change password and continue. The new password follows the same rules as registration: at least 8 characters with an upper-case letter, a lower-case letter, a digit and a special character. It must differ from your current one; otherwise Sentinel says Choose a password different from your current one. A wrong current password is shown under that field. After success, Sentinel opens the page you were going to. If the sign-in took too long, the page says This sign-in has expired; select Sign in again and repeat the sign-in. Use Back to sign in at the top of the page to leave without changing it. While the password is expired, an open session can only change the password, view your own profile, check password status and sign out. You can also change it in Profile or use Forgot password, which sets a new password and restarts the period. A reset refused for reusing the current password leaves the reset link usable.

Organisation administrators choose the period in Settings → General, in the organisation Security card, under Password rotation: Every 3 months, Every 6 months or Every 12 months. The card says how long the period currently is, and whether it is the platform default. Options longer than the platform default are disabled with a note such as "Platform maximum is N months." Select Use the platform default to follow the platform period, including later changes to it. If the platform default is lowered below your chosen period, the shorter platform period applies and the card still shows your choice until you change it. Select Save security settings and confirm Save security settings? with Save. Other members do not see the card and can only read the period through the API (GET /api/v1/organizations/{id}/settings/password-policy).