Skip to main content

Logging in and first-time setup

The dashboard at dashboard.drukverify.com has three entry points: signing in as an existing user, accepting an invite as a new teammate, and the initial-admin setup flow when a tenant is first provisioned.

Returning users: sign in​

  1. Open dashboard.drukverify.com, enter your email, continue.
  2. Enter your password.
  3. Enter the 6-digit TOTP code from your authenticator app. If you have lost access to it, click Use a backup code instead; each backup code is single-use.

On success the dashboard mints a dv_dash session cookie and redirects to /. Sessions last 12 hours; after that you are sent back to /login.

First-time setup (initial admin)​

When your tenant is provisioned, ops sends a one-time setup link of the form dashboard.drukverify.com/setup?token=<setup-token>. The token is single-use and time-bound.

  1. Open the link. The page validates the token and shows the email address it is bound to.
  2. Choose a password.
  3. You are sent to enroll TOTP: scan the QR code with your authenticator app, or paste the manual-entry secret.
  4. Enter a 6-digit code to confirm the binding.
  5. Save the six backup codes shown. They appear exactly once; each is single-use and lets you sign in if you lose the authenticator.

Once TOTP is bound and the backup codes acknowledged, the dashboard mints your first dv_dash cookie and lands you on /.

Accepting an invite (teammate flow)​

An admin's invite arrives by email as dashboard.drukverify.com/setup?invite=<invite-token>. The flow is the same as above, except the page shows the tenant you are joining and the role the inviting admin chose. Invite tokens expire after 7 days; if yours has, ask the admin to re-send from the Team page.

Lost authenticator and backup codes​

Contact ops@drukverify.com from the email address tied to your dashboard user. Ops resets the TOTP binding after out-of-band identity verification; you then re-enroll and receive a fresh set of backup codes.

Session lifecycle​

  • dv_dash is an HTTP-only signed cookie. There is nothing useful to read from it in JavaScript.
  • A user can be signed in from several devices at once.
  • Signing out clears the cookie on the current device. Removing a user on the Team page invalidates every session they hold.