Authentication And 2FA

RevenuePilot separates staff authentication from portal authentication and supports password login, OTP, TOTP, account status screens, reset links, and security monitoring.

Staff Login

Staff users authenticate from /login. Admins can enforce password policy, lockout behavior, password expiry, remember-me behavior, and logout-on-password-change.

OTP And TOTP

Email OTP and authenticator-app TOTP protect high-risk access paths. TOTP settings should be available to permitted users, and portal two-factor codes are handled through the portal auth flow.

Reset And Lockout

Password reset links require working mail. Account lock, banned, suspended, verification, and forced password reset states should be tested after SMTP setup.

Security Audit Trail

Authentication events flow into notifications and activity logs so administrators can investigate OTP generation, password reset, account lock, TOTP changes, and session events.