Register
/register exists when "Visitors may create an account without ordering" is on; otherwise it sends the visitor to the store, where an account is made at checkout. The form asks for the client's details (first name, last name, company, email, address, city, state, postcode, country, phone, tax number; the fields listed under "Details that are optional when signing up" are optional, company, second address line, state, postcode and tax number always are), the custom fields marked "Ask at sign-up and checkout", a password typed twice (at least the strength set in General Settings), the marketing tick box, the terms of service tick box when required, and a captcha when the Security settings ask for one on registration. Email providers listed under Settings > Banned Email Domains are refused.
A new client gets the currency of their country (local currency at home, the world currency elsewhere, when currency by country is set up, else the default), the welcome email, and, when email confirmation is on, the confirmation email. Staff with account notices get "New client signed up". The new client is signed in at once and lands on the dashboard. A visit that came through an affiliate link is credited to the affiliate.
Sign in
The sign-in, registration, password reset and two-step pages share one frame: the company logo or name above a centred card, and a footer with links to the home page, store, knowledgebase and contact page, the theme switch and the language menu. /login asks for the email address and password, with "Forgotten your password?" and "Create an account" underneath, and a captcha when "Sign in" is among the captcha forms. After five failed attempts (General Settings, Security, "Failed sign-ins before a ban") the address is banned for the set number of minutes; repeated failures for one email address are also slowed down. A disabled user cannot sign in.
Two-step sign-in: a user who has set it up is asked for the 6-digit code from their authenticator app on /login/code after the password. A recovery code (longer than 8 characters) works once in its place. Five wrong codes end the attempt. With "Clients must set up two-step sign-in" on, a user without it is sent to Security Settings at every page until they set it up (staff signed in as the client are not).
A user with one account lands in it; a user with several chooses one on /account/switch (see Switch Account). The page the person asked for before signing in is opened afterwards when it is on this site.
Password reset
"Forgotten your password?" opens /password-reset. The person types the address they sign in with; the page says a link was sent if an account uses that address, and says the same when none does. The link, in the email "Password reset link", works for one hour and once. /password-reset/TOKEN asks for the new password twice; saving it signs the user out everywhere else, confirms the email address and sends "Password changed". An expired link shows a message to ask for a new one. Five requests an hour per address are allowed, and a captcha can be asked for.
Email confirmation
/verify-email/TOKEN is the link in the confirmation email. It marks the address confirmed and shows "Thank you, your email address is confirmed", or says the link has expired. The link works for 48 hours.
Invitation
/invite/TOKEN is the link in an invitation email. It names the account. A signed-in person presses Accept Invitation; a person whose address already has a sign-in is sent to sign in and open the link again; anyone else types their name and a password and presses Create Sign-in and Accept. Either way they land in the account. An expired, used or cancelled invitation says so.