Plan: Sign-in, reset, and two-factor are on every plan including the 30-day Starter trial. After you confirm your email, email sign-in codes are on. Authenticator remains optional.
You always sign in as a staff user. PayBlah does not sign in as your customers. Logging in does not send them anything.
Before you start
- Use the work email from signup or the invite.
- A password must be at least 12 characters.
- Do not turn factors off, and do not ask a teammate to clear your two-factor. A workspace Admin cannot do that from the product.
Try these in order
- Open /app/login. Heading Welcome back. Enter Email and Password. Click Log in.
- Unknown email and wrong password both show: That email and password do not match an account.
- Unconfirmed mailbox: confirm first, or use Resend confirmation email on the same card. Login does not open a session until the mailbox is confirmed.
- Forgot the password: click Forgot password? → Send reset link. The next card is always Check your email, whether or not the address has an account. The link lasts 60 minutes and works once.
- On Choose a new password, enter New password and Confirm new password. Click Save new password.
- You return to login with Password updated. Log in with your new password. The reset never signs you in. Other browsers and devices signed in as you fail closed on their next request.
- After a correct password, any enabled factor parks a pending challenge — not a full session. Heading One more step. Enter the email code, authenticator code, or a recovery code. Click Verify. Wrong person? Start again.
- If you belong to more than one workspace, pick the Business and click Continue.
Sessions
A session stays usable for about 2 hours of idle time. It ends after 12 hours from the moment it was issued, even if you keep clicking. Sign in again when that happens. There is no customer-facing device list and no “log out other devices” page. Changing your password or completing an email change ends sibling sessions on the next request.
Expected result
After password plus One more step (when a factor is on), you land on the Dashboard or setup. Main nav includes Dashboard, Invoices, Customers, Workflows, Activity, Reports, Settings, and Support.
If you are still locked out
- No email: check spam. Reset and resend pages will not tell you whether the address exists.
- Expired or reused reset link: request a new one.
- Workspace still preparing: wait a minute and try again.
- Lost phone: use a recovery code you already saved in the same One more step box. Then generate a new set after you are in.
- No recovery codes and no other factor: contact support from another channel after you can prove you control the account. Do not send recovery codes in chat. Do not ask anyone to bypass or disable two-factor for you.
- Owner unreachable with no other Admin: that is an ownership problem, not a two-factor bypass. See transfer ownership for why a second Admin matters.