Authentication
Authentication is how CROForge proves you are the person who owns an account before letting you into the product. In everyday life it is like showing ID at a building door. In CROForge it is the sequence of Register, Login, verify email, and optional 2FA that unlocks your workspaces and campaigns. Until you complete these steps, you cannot open experiments, Data Vista, events, or settings.
Words used on this page
| Word | Everyday meaning | Meaning in CROForge |
|---|---|---|
| Authentication | Proving who you are before you are allowed in. | The sign-in system that checks email, password, email verification, and optional 2FA before you reach a workspace. |
| Account | Your personal membership with a service. | Your CROForge login identity (email and password). One account can belong to several workspaces. |
| Register | Signing up for the first time. | Create an account with email and password. If you arrived from an invitation, registration can include an invite token so you join that workspace automatically. |
| Login | Signing in with details you already have. | Sign in at /login to open workspaces and campaigns. If 2FA is on, a verification modal appears next. |
| The address people use to reach you. | Your unique login identifier. Invites and password-reset messages are sent here. | |
| Password | A secret phrase that only you should know. | The first proof of identity. Change it from Settings → Profile. Reset it from forgot-password if you are locked out. |
| 2FA | A second proof after the password, like a code from your phone. | Two-factor authentication. When enabled on your profile, login opens a 2FA challenge modal and you must enter a code before entering the app. |
| 2FA challenge / 2FA modal | A pop-up that asks for the extra code. | The dialog shown after password login when 2FA is enabled. You cannot reach the dashboard until the code is accepted. |
| Verify email | Confirming that an email address really belongs to you. | A confirmation step at /verify-email. You can resend the verification message if the first one never arrived. |
| Forgot password | Asking a service to help because you cannot remember the secret. | The page at /forgot-password where you request a reset email. |
| Reset password | Choosing a new secret after proving you own the email. | The page at /reset-password that completes a token-based reset from the email link. |
| Token | A short-lived ticket that proves a request is genuine. | A one-time value in reset and invite links. Do not share it. CROForge uses it to finish password reset or join a workspace. |
| Invite token | A ticket that says “this person was asked to join.” | Carried when you register from an invitation so the new account is attached to the invited workspace. |
| Invitation | A request asking someone to join a group. | A workspace invite accepted at /invite after login or registration. |
| Session | The period you stay signed in after proving who you are. | Kept with cookies after a successful login so you do not re-enter credentials on every page. |
| Cookie | A small note a website stores in the browser. | Where CROForge stores session and token values so the app remembers you are signed in. |
| Route | A web address for a specific screen. | App paths such as /login, /register, and /dashboard. |
| Modal | A window that appears on top of the page and asks you to finish one task. | Used for the 2FA challenge during login. |
| Dashboard | The home screen after you sign in. | The gate at /dashboard. It sends you into your default workspace, or asks you to create a workspace if you do not have one yet. |
| Workspace | A team’s private work area. | The isolated container for experiments, Data Vista, events, websites, users, and Smart Code. Authentication is what gets you into one. |
| Campaign | A planned marketing effort. | The UI name for an A/B experiment. You only see campaigns after you are authenticated and inside a workspace. |
Screenshot placeholders for this page: login-screen.png and forgot-password.png. Replace those files with real screenshots and keep the same filenames.
What authentication does for you
CROForge stores experiments, visitor data, and team membership inside workspaces. Authentication is the lock on that door. Register creates the lock and key. Login uses the key. Verify email proves the mailbox is yours. 2FA adds a second key that a stolen password alone cannot copy. Forgot and reset password let you replace a lost key without creating a second account.
Features
| Feature | What it is in plain language | What happens in CROForge |
|---|---|---|
| Register | Create a new membership. | Create an account with email and password. Supports an invite token when you join from an invitation. |
| Login | Sign in with an existing membership. | Sign in to access workspaces and campaigns. |
| 2FA challenge | A second check after the password. | If 2FA is enabled, login opens a verification modal. You must complete it to continue. |
| Verify email | Confirm the mailbox is real. | Confirm email at /verify-email. Resend verification when the message is missing. |
| Forgot / reset password | Recover access when you cannot sign in. | Request an email link, then complete a token-based reset. |
App routes
A route is the address of a screen. These are the authentication screens in the app:
| Path | Purpose |
|---|---|
/login | Sign in. If 2FA is enabled, the 2FA modal appears after the password step. |
/register | Create an account. |
/verify-email | Confirm the email address on the account. |
/forgot-password | Request a password-reset email. |
/reset-password | Complete the reset using the token from the email link. |
/invite | Accept a workspace invitation. |
/dashboard | Gate after sign-in. Opens the default workspace, or prompts you to create a workspace. |
How to sign up and sign in
Typical client workflow
- Open the CROForge app URL.
- Choose Register if you are new, or Login if you already have an account.
- Complete email verification and the 2FA challenge if the product asks for them.
- Land on the dashboard or workspace selection.
- If you cannot sign in, use forgot password then reset password.
Register
Use Register when you have never used CROForge. Enter an email and a unique password. If a teammate invited you, open the invite link first so registration can carry the invite token and attach you to that workspace. After you submit, check your inbox for the verification message.
Login and the 2FA modal
Use Login at /login with the same email and password. If you turned on 2FA in Profile, a modal asks for the second code. That code comes from the authenticator app or token flow you set up. The password alone is not enough. After a successful challenge you continue into the dashboard.
Verify email
Verify email confirms the mailbox is yours so reset links and invitations reach the right person. Open /verify-email from the message, or resend verification from the product if the first email never arrived. Until the address is confirmed, some workspace actions may be blocked.
Forgot and reset password
If you are locked out, open /forgot-password, enter the account email, and wait for the reset message. The link contains a short-lived token. Opening it takes you to /reset-password, where you choose a new password. Treat that link like a spare key: do not forward it.
Security notes
- Use a unique password that you do not reuse on other sites.
- Enable 2FA in Profile. This is especially important for Owner and Admin accounts.
- Do not share reset links or invite links. Anyone with the token can finish that action.
- Sign out on shared computers so the session cookie is not left behind.
2FA is a second proof of identity. In CROForge it is optional until you turn it on, then it becomes required at every login.
Developer notes
These files are the frontend code that implements authentication. They are not screens you click in the product. They are the programs the app uses behind the scenes:
lib/auth.ts— auth services (register, login, verify, reset, 2FA calls).lib/cookies.ts— session and token cookies stored in the browser.context/AuthContext.tsx— shared “who is signed in” state for the React app.
For running the frontend locally, see Local setup.
