Accounts & authentication

How to sign up, log in, secure your account and manage access.

Sign up is done by choosing a plan (Basic / Pro / Max) - there is no “direct” sign up without a plan. One exception: someone invited to manage another person’s account creates their access without choosing a plan (see “Managing someone else’s account”). The process:

Plan selection.
Phone number verification (by SMS or WhatsApp) before the trial starts.
Email address verification in parallel.
Start of the 14-day trial, with no payment information; the payment method is only requested upon conversion.

As long as the phone number is not verified, only access to the dashboard is blocked: you can continue browsing the public site and your account page. You are only redirected to the verification step when you try to open the dashboard.

[!NOTE] A customer who has already had an active subscription (account already paying) does not need to verify their phone number to access the dashboard: this step only applies to new accounts, never to existing customers.

Email address verification

As long as the address is not verified, a reminder remains displayed in the sidebar of the dashboard, with a button to resend the verification link. The reminder disappears on its own once the address is confirmed.

By clicking on the link you receive, you return to the application with a confirmation message - whether you are already logged in or not. An already-used link simply displays “address already verified”.

Log in

Two methods:

Email + password.
Google (only social provider offered). Google must have verified the associated email address; otherwise login is denied.

On the login and sign-up pages, the “Continue with Google” button comes first: one click, no password to remember. If your browser is already signed in to a Google account, a small “Continue as …” window may also appear at the top of the page (at the bottom on mobile): one click signs you in, or creates your account with the plan you chose. If you close it, Google will not show it again for a while; the button is always there.

If two-factor authentication is enabled on your account, Google login also requires your code (authentication app or backup code) before opening the session - like password login.

Forgot password

Reset is done by email, self-service, from the login screen.

Two-factor authentication (2FA)

2FA adds a one-time code to login, in addition to the password. It is managed self-service from the Security page of your account.

Activation (authentication app): scan the QR code with Google Authenticator, Authy or equivalent (or enter the key manually), then confirm with the 6-digit code from the app. This is the only activation step - no SMS code is requested at this time.
SMS (login backup): when logging in, you can receive a code by SMS on the verified phone number of your account, as an alternative to the app code. SMS is therefore only used at login, not at activation.
Recovery codes: upon activation, one-time backup codes are provided. Keep them in a safe place: they allow you to log in if you lose access to your app and phone.
Administrator accounts: 2FA is mandatory and cannot be disabled.
Reminders while it is disabled: 2FA stays optional for customers, but RepOtz recommends it. Until it is enabled, and once setup is complete, the dashboard home shows a « Protect your account with 2FA » card (Later button: the card comes back 30 days later), the Security entry of the account menu carries a Recommended label and the avatar an orange dot. Everything disappears once it is enabled.

Note: A customer who has lost access to their 2FA (app and SMS) can be supported by support.

Inviting someone to manage your account

You can entrust the management of your account to someone else (a partner, an employee, a contractor) without sharing your password. It is included in every plan, at no extra cost, for up to 10 people per account (access and pending invitations together).

In Account, the Users card lists who manages the account with you. Click Add a user, enter their email address and tick the areas you entrust to them (“Select all” ticks them all). One tick = see and manage that area:

Businesses and contact points; Widget
Campaigns, forms and customisation; QR codes and short links; Review platforms and link page; Invitations; Contacts
Internal feedback; Google reviews; Video testimonials; Analytics
Billing: the person will be able to change plan, change the card, cancel the subscription and order NFC cards on your behalf
Integrations, API tokens and webhooks: a token or a webhook gives lasting access to the account’s data; you receive an email for every token created by someone other than you

The person receives an invitation by email, in the language of your screen when you send it, valid for 7 days. You can send it again (a new link replaces the old one) or cancel it.

Always kept by the owner: inviting or removing people, the currency, starting the trial and deleting the account. The account’s alerts (new internal feedback, unanswered Google review, broken link) keep going to the owner.

At any time you can edit someone’s areas or remove them: it takes effect right away. On removal, RepOtz offers, ticked by default, to revoke the API tokens and switch off the webhooks that person created. The card also shows whether the person turned on 2FA and when they last came.

Managing someone else’s account

Received an invitation? Open the link in the email: the page shows who invites you, to which account, and what you will be able to do there. Opening the link commits you to nothing.

You have no RepOtz access yet: create it from the invitation. No plan to choose, no subscription, no phone verification: you work in the account of the person inviting you, under their subscription.
You already have an access (you may be a customer yourself): sign in, then accept or decline.

The invitation can only be accepted with the email address it was sent to. If you are signed in with another address, the page says so and offers to sign you out to continue.

Once the invitation is accepted, the menu shows Managed accounts: your own account (Owner badge) and the ones you manage. Pick one to work in it. A banner at the top of the screen always reminds you which account you are in, and you only see the areas entrusted to you. If an action requires a higher plan or a payment and billing was not entrusted to you, RepOtz tells you that only the owner can do it.

You can leave a managed account whenever you want. If you delete your profile you lose access to the accounts you manage, but those accounts are not deleted. And if one day you want your own account, open it from the “Managed accounts” page by choosing a plan: the usual path then applies (phone verification, 14-day trial).

Quick account access and logout

In the dashboard, everything about your account is in the account menu (avatar in the top right): Account, Preferences, Security, Billing, the NFC shop, API tokens, a link to the public site and Log out. The sidebar is kept for your businesses, campaigns and reviews. Next to the avatar, the bell opens the notification journal (see below).

Session persistence

After refresh, the selected activity and session are preserved.

Alerts and notification channels

In Account > Preferences, the Alerts by channel card lets you choose, for each alert type, the channels that transmit it to you: email and push notification (with your browser’s permission) are available on every plan; SMS and WhatsApp are included in the Max plan and go to the account’s verified phone number. WhatsApp covers every adjustable alert: new feedback, low rating, video testimonial received, broken or disabled platform link, unanswered Google review and disabled webhook. If an alert is not available on WhatsApp, its column shows a dash and the alert stays available by SMS. They are never switched on for you: you turn them on alert by alert, and each activation records the date of your consent. On another plan, both columns show « Max plan »; without a verified number, « phone needed » with a link to verify it; « soon » means the channel is not open yet. The card also shows the numbers these alerts come from: save them as contacts, otherwise your phone may flag them as spam. To stop a channel, reply STOP to any message: it is turned off for all your alerts. To turn it back on, reply START to the same number: the alerts the STOP switched off come back on, without going through the page, and a message confirms it. After texting STOP, START is also what lifts the carrier block. If the account leaves the Max plan or the subscription ends, your choices are kept but no SMS or WhatsApp message goes out. Every message appears in the notification log, with its exact text. Adjustable alerts: new feedback, low rating (2 or below), video testimonial received, broken or disabled platform link, unanswered Google review, disabled webhook. Billing and security emails, as well as invitations sent to your customers, are not affected.

Two settings combine: the channels chosen here, and, for feedback, the “email with each feedback” option of each location. Enabling a channel records the date of your consent.

Account name

The account name is the one the RepOtz emails about this account show: monthly report subject, billing emails. The owner changes it in Account > Account name; the people managing the account cannot change it. Accounts that came from the previous version of RepOtz carried a technical name (”… workspace #1”): they were renamed in September 2026 after their business (or their original name when they have several), and can still be changed.

Notification journal

The bell icon at the top of the dashboard opens the Notifications page: every message RepOtz sent to the account owner (new feedback, unanswered Google reviews, broken links, monthly report, billing, and so on), newest first. Each message opens exactly as it was sent by email, and the page shows whether it went out by email and as a push notification.

A message whose email you switched off in your preferences is there anyway, marked “Not sent by email”: you read it as it would have been sent. The same goes for the monthly report of an account that unsubscribed from the email.

The people who manage your account see the whole journal, and the bell count is their own: opening a message marks it read for you only. Each message shows who read it and when. The “Mark all as read” button clears your count at once. Messages are kept for 24 months, then erased automatically; they cannot be deleted by hand. The journal starts when the feature went live (September 2026): older messages are not in it.

Not in the journal: security emails (password, address verification), which carry personal links, and the invitations sent to your customers.

Frequently asked questions

Q. Can I give an employee or a contractor access to my account without giving them my password? A. Yes. In Account, “Users” card, invite them by email and tick what they will manage. It is included in every plan, for up to 10 people. You can edit their areas or remove them at any time.

Q. Does the person I invite have to pay for a subscription? A. No. They create their access from the invitation without choosing a plan and work in your account, under your subscription.

Q. I accepted an invitation: how do I switch between accounts? A. Through the “Managed accounts” entry of the menu. A banner at the top of the screen shows the account you are working in.

Q. Do I need to enter my card to start the trial? A. No. The 14-day trial requires no payment information.

Q. Can I log in with Google? A. Yes. It is the only social provider offered.

Q. How do I enable two-factor authentication? A. From the Security page of your account, with an authentication app (6-digit code); no SMS is requested at activation. At login, an SMS code can serve as backup. Remember to keep your recovery codes.

Q. I lost my phone and my recovery codes, I can no longer log in. A. Support can reset your 2FA after verification; you reconfigure it at your next login.

Q. Why can’t I disable 2FA? A. If your account is administrator, 2FA is mandatory and cannot be disabled.