Accounts and signing in · Joripo documentation

Creating an organisation

There are two ways an organisation comes into being on a Joripo server:

Sign up. Where the server's maintainer has left sign-up open, Start free (/signup) creates a new organisation with you as its owner, on the Free plan, and signs you in. What each plan includes is on the pricing page. The maintainer can close sign-up for the whole server; one network address may sign up at most three times an hour.
First-run setup. On a brand-new server with nothing in its database, the first visit opens Set up Joripo, which creates the organisation and its first owner. Do this before you tell anyone the server's address: until an owner exists, whoever reaches the page first can claim it.

The server's maintainer can also create organisations and their first owner from Server administration.

Signing in

Sign in at /login with your email address and password. The page does not ask which organisation you belong to: your email identifies your account. Two kinds of link change this a little:

a link of the form /login?server=<server name> (shown under Configure › Server settings) names your organisation on the sign-in page and holds the sign-in to it;
where the server gives each organisation an address of its own (https://<server name>.<domain>), that address signs in only that organisation's people.

Data collectors may be given a username (enum01) instead of an email address. They use it on Joripo Collect, with the server name; see Signing in on Joripo Collect.

Closing the browser signs you out, and so does leaving Joripo unused for two hours. Sign in again and you return to the page you were on.
However busy you are, a sign-in ends seven days after it began.
Keep me signed in on this computer, ticked when you sign in, keeps you signed in for 14 days without use (renewed each time you use it), and at most 30 days. Leave it unticked on a shared computer.
Typing in the form editor, the form tester or a web form counts as using Joripo. If you are signed out anyway while working there, nothing is lost: Joripo asks you to sign in again in a new tab and sends your work when you come back and press Try again.
Sign out in the account menu ends your sign-in in every browser. A new password, a lower role or being deactivated does the same.

A page that refreshes itself (the quality findings refresh every 15 seconds) does not count as use, so a tab left open on its own is still signed out after two hours.

Passwords

At least 12 characters for owners, managers and reviewers; at least 4 for a data collector, whose password is typed on a phone. Passwords do not expire.
A password an owner sets for you (when adding you, or as a new password) is temporary unless they untick They choose their own password: at your first sign-in you choose your own, and nothing else opens until you do. Joripo Collect cannot change a password, so a data collector who must choose one is told on the phone to sign in on the web first.
Change your own password at any time from the account menu (Change password), entering the current one first. Changing it also revokes your API tokens and Joripo Desktop connections unless you untick Also revoke my API tokens.
Passwords are stored only as scrypt hashes; nobody, including the server's maintainer, can read yours.

Forgotten passwords

Joripo does not send email for password resets. Forgot password? on the sign-in page leaves a request for your organisation's owners: they see it under People › Password reset requests, set a new password for you and give it to you directly. The page answers the same whether or not the email has an account, and requests are limited per address and per email, so it cannot be used to find out who has an account.

If you are the organisation's only owner and have lost your password, ask the server's maintainer, who can set a new one from Server administration.

Too many wrong passwords

Eight wrong passwords for one account, or thirty from one network address, within 15 minutes, block further tries for a while. The same limits apply on every door: the sign-in page, Joripo Collect, ODK Collect with a password, and Forgot password. The counts are kept in the database, so restarting the server does not reset them.

Your account page

Your account (/account, from the account menu) lists your personal API tokens for pulling data with a script and the Connected computers running Joripo Desktop as you, each with Revoke. See Pulling data with a script and Joripo Desktop.