Scope
Every staff account requires a phone number, which is its primary sign-in identifier. Oto normalizes phone numbers to include the applicable + country code. Email is optional and is not used as the primary identifier. Access links expire. Public forms use the token or code issued for that workflow. Returning camp families receive a six-digit code on the entered phone number before saved family details are shown or changed. Reception and employee kiosks use their documented activation, session, PIN, or face-identification flows.
Design
A staff member submits their phone number and password. Oto normalizes the phone number to include the applicable + country code before finding the account. A successful login creates the application session and opens the permitted landing page. Sign-out ends the current session. Password recovery, required password change, and phone verification follow their documented account flows. Access links open only their associated workflow and stop working when they expire or are revoked. During public camp registration, entering a phone number that matches saved family details sends a six-digit code to that number; the visitor must enter the code before Oto reveals or updates those details. Public and kiosk credentials apply only to their associated workflow.
Failure handling
Invalid or disabled accounts are rejected without revealing whether an identifier belongs to an account. An incorrect or expired camp verification code does not reveal or update saved family details. Invalid, expired, or revoked public and kiosk credentials do not open the protected workflow.
Requirements
- Every staff account requires a phone number and uses it as the primary sign-in identifier; Oto normalizes it to include the applicable + country code, and email is optional.
- Sign-out ends the current session.
- Password recovery, forced password change, and phone verification use their documented account flows.
- Returning camp-family details require the six-digit code sent to the entered phone number before they are shown or changed.
- Every access link has an expiry determined by its link type and stops working after that expiry.
- Public and kiosk credentials cannot be used as staff account credentials.
Verification
- Test valid, invalid, and disabled staff account sign-in.
- Test sign-out and the documented password and phone-verification flows.
- Test correct, incorrect, and expired six-digit codes for returning camp-family lookup and updates.
- Test that each access link stops working after the expiry defined for its link type.
- Test each public and kiosk credential only against its associated workflow.