Sign in to your account

Sign in to reach the dashboard, your services and your billing. You sign in with the email address and password you chose when you created the account, and with a code from your phone if you use two-factor authentication.

• A Coritan account and its password. If you have forgotten the password, reset it first.
• If two-factor authentication is on, your authenticator app, or one of your recovery codes.

1. Go to coritan.com/login, or select Sign in at the top of any coritan.com page.

2. Enter your Email address and your Password.

3. If a verification check appears under the password, complete it.

4. Select Sign in.

5. If two-factor authentication is on, the page asks you to Check your authenticator. Type the six digits your app shows into Authentication code. The page signs you in as soon as you type the sixth digit. For a pasted code, select Verify and sign in.

   To use a recovery code instead, select Use a recovery code instead and type one of the codes you saved. Each recovery code works once.

The dashboard opens. If you were on another dashboard page when you were asked to sign in, that page opens instead. After a recovery code, a message tells you how many codes you have left: make a new set before they run out.

The browser stays signed in until you sign out. Sign out and end sessions explains how long that lasts and how to end it.

Invalid email or password. Check both and try again.

The email address or the password is wrong. The message is the same for both. Check them, or select Forgot password? to reset the password.

Account is suspended or closed

The account cannot sign in. Contact support.

Complete the verification check to continue.

The verification check under the password is not finished. Complete it, then select Sign in again.

The verification check did not pass. Complete it and try again.

The check expired or failed. It resets on its own; complete it again.

Too many authentication attempts. Please try again later.

Too many sign-in attempts failed from your network in the last minute. Wait a minute, then try again.

That code is not right

The code is wrong or already used: each code works once. Wait for the next code in the app. If every code fails, check that your phone's clock sets itself automatically, because the codes depend on the time.

Invalid or expired token

More than ten minutes passed between your password and your code. Select Sign in to a different account and sign in again.

Too many requests for this action. Please wait and try again.

You tried more than ten codes in five minutes. Wait a few minutes before the next try.

You lost your phone and your recovery codes

Contact support and say which account it is. Coritan staff can turn two-factor authentication off on the account. You then sign in with your password and set it up again on your new phone.

• Change or reset your password
• Turn on two-factor authentication
• Sign out and end sessions

Sign in with POST /auth/login, then send the access_token it returns as Authorization: Bearer <token>. Make your first API request walks through it with curl.

curl -X POST https://api.coritan.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "alex@example.com", "password": "your password"}'

{"access_token": "eyJhbGciOiJIUzI1NiIs...", "refresh_token": "eyJhbGciOiJIUzI1NiIs...", "token_type": "bearer", "expires_in": 1800}

expires_in is the access token's lifetime in seconds. When it runs out, exchange the refresh_token for a new pair with POST /auth/refresh and the body {"refresh_token": "..."}. The answer has the same fields, with a new refresh token to keep.

When two-factor authentication is on, the sign-in answers with a pending token instead:

{"mfa_required": true, "mfa_setup_required": false, "mfa_token": "eyJhbGciOiJIUzI1NiIs...", "expires_in": 600, "token_type": "bearer"}

Send the code to POST /auth/mfa/verify within ten minutes, with the mfa_token as the bearer token and {"code": "123456"} (or a recovery code) as the body. It answers with access_token, refresh_token, token_type and expires_in, plus how (totp or recovery) and recovery_codes_left. Every other endpoint refuses the mfa_token with 401 and "error": "mfa_required".

GET /auth/turnstile says whether sign-in needs the verification check: {"enabled": true, "site_key": "..."}. When it is on, POST /auth/login also needs the turnstile_token the check produces, and answers 403 with "error": "turnstile_failed" without it.