Security & compliance
Authentication flows
Password and magic-link sign-in, token and session lifetimes, forced password change, persona redirects, and the identity features that are not available.
Security & compliance guide for day and boarding schools.
Last updated August 29, 2026
Every account signs in with a username or email and a password checked against a bcrypt hash. NextAuth is registered with a single credentials provider, so there is no Google, Microsoft, Entra or SAML button on the sign-in screen, and no second factor after the password. Parents and students get one extra route: a link emailed to the address on their account.
| Flow | Path | Audience |
|---|---|---|
| Sign in | /signin | All users - five role tabs |
| Sign up | /signup | Self-registration where enabled |
| Email verify | /verify | New accounts - confirm email |
| Forgot password | /forgot-password | Request reset link |
| Reset password | /reset-password | Set new password from token |
| Magic link | /signin (email link) | Parent and student only - 15 min expiry |
How long each credential lasts
Every lifetime below is fixed in code rather than in school settings, so shortening a session for a shared staff room is a code change rather than an option somebody can toggle.
| Credential | Lifetime | Where it is set |
|---|---|---|
| Session with Remember me ticked | 30 days, refreshed daily | session and jwt maxAge in lib/auth.ts |
| Session without Remember me | 8 hours from sign-in | JWT callback sets an explicit expiry |
| Magic link from the sign-in screen | 15 minutes, single use | lib/auth/magic-link.ts |
| Welcome link for a new parent account | 24 hours, single use | Sent when office staff create the portal user |
| Password reset link | 1 hour | Issued by /forgot-password |
| Email verification link | 24 hours | Issued at sign-up |
Must-change password
Accounts created with mustChangePassword=true cannot use the rest of the app until they set a new password at /profile. Enrollment creates student portal users with this flag; admin-created users, bulk imports, and staff onboarding from careers follow the same pattern. A new password must be at least eight characters and mix upper case, lower case, a digit, and a symbol. After a successful change, the flag is cleared.
Limits to state plainly
- No single sign-on of any kind. Only the credentials provider is registered with NextAuth.
- No multi-factor authentication. There is no TOTP, one-time-code, or recovery-code field anywhere in the schema.
- No account lockout or backoff after repeated wrong passwords. Failures land in the activity log; the account stays open.
- Magic-link, sign-up, and password-reset requests are capped at five per minute per IP address. Password sign-in itself runs through NextAuth and is not capped.
- No directory provisioning. Accounts are created in Schoolyi and are not synchronised from Google Workspace or Microsoft 365.
Product docs access
- /docs is public - anyone can read setup guides and workflows without signing in
- While signed in, open documentation anytime from the header Docs icon → /docs
Common questions
Quick answers in plain language.
Why can a parent sign in with an emailed link but a teacher cannot?+
Magic link is deliberately restricted to userType parent or student, or the Parent and Student roles, in lib/auth/magic-link.ts. Staff, teachers, and vendors have a password only. The link lasts fifteen minutes, is single use, and is deleted once consumed.
Why does a member of staff get signed out after a working day?+
The session length depends on the Remember me checkbox at /signin. Without it the token expires eight hours after sign-in; with it the session runs for thirty days and refreshes daily. Both values are set in lib/auth.ts and cannot be changed from a settings screen.
Does an account lock after repeated wrong passwords?+
No. A failed attempt is written to the activity log as LOGIN_FAILED with the reason, but nothing disables the account or introduces a delay. If you need lockout, treat it as a control your reverse proxy or your policy has to supply.
A new member of staff is stuck on the profile screen and cannot reach anything else. Why?+
Their account has mustChangePassword set, so the app shell calls /api/auth/check-password-requirement and redirects to /profile?mustChangePassword=true until a new password is saved. Accounts created by an administrator, by bulk import, and by admissions enrolment all start in this state.
Related searches
School leaders and IT teams often search for: how to authentication in school management software, best student data privacy schools for K-12 schools, Schoolyi authentication guide, school software security, FERPA compliant school software, and school data protection.