Accounts & Authentication

Creating a Business Account

Business accounts are created in the Get Started flow. Open it from Create an account on the sign-in page, or go straight to the business path at /auth/business-signup (it opens /get-started/business).

1. Choose I run a business (skipped when you use the business link).
2. Let's get you set up: enter your First name, Last name, Email address and Password (at least 8 characters), then click Sign up. Your account is created on the spot; there is no confirmation email to wait for.
3. Answer a few questions about your business, one per screen: your yearly revenue, how you run your memberships today, how many members you have, what would make MemberZone a win for you, and whether you have members to bring over. Then Tell us about your business (autofill from your website, or enter it yourself), its name, and What kind of business is it?
4. Add your first location (and any others).
5. Let's set up your club together (in your business's word): book a setup call with a MemberZone specialist, or click I've booked my call. Then Go to my dashboard opens HQ at /hq.

Until MemberZone unlocks setup for you, HQ shows "Thanks, {name} - your account is ready" and an I already have an activation code link. Once it's unlocked, HQ offers Continue setup to open the guided builder. See Registration and Onboarding.

If you are already signed in, the business link skips account creation and goes straight to the questions.

---

Creating a Member Account

There is no signup form for members. A member account is created when you:

• Join a club, membership or program at checkout. Checking out as a guest creates your account, without a password, and signs you in. See How to Join.

If the email you check out with already has an account (from a rewards program, an import, or another business), checkout doesn't create a second one: the membership or store order is added to the account already on file, and checkout tells you so as you type the email. You aren't signed in, because anyone could type that email, and nothing from the account is shown. Your confirmation or welcome email has a secure sign-in link; sign in to see your purchase. A checkout's sign-in form also offers Email me a sign-in link for accounts without a password.

• Accept an invitation from a business. The welcome email's link signs you in and creates your account.
• Join a business's rewards program from its rewards join page. The sign-in link emailed to you creates your account (see Magic Link below).

If you choose I'm joining a membership club in Get Started, MemberZone asks you to check your welcome email (the business you're joining sets up your membership) and offers Sign in to your account.

---

Logging In

MemberZone supports two ways to log in at /auth/signin:

Email and Password

1. Go to /auth/signin
2. Enter your Email address and Password
3. Click Sign in
4. You are directed to the right place for your account:
   • Business owners and staff go to HQ (/hq)
   • Members go to their memberships (/member/memberships)

If you followed a link to a page that needs you signed in, you land back on that page instead.

Magic Link (Passwordless)

MemberZone supports passwordless sign-in via magic links - one-click email links that sign you in without typing a password.

Where magic links are offered today:

Surface	When you'll see one
Sign-in page	Click Send me a magic link on /auth/signin and enter your email
Rewards Program login / join	/b/{business}/rewards/login and /b/{business}/rewards/join - enter your email to receive a sign-in link
Release-opened emails	A release notification email can include a one-click sign-in link that lands you directly on the selection or membership page
Member invitation emails	Clicking the invite link signs you in and creates your account on the spot

Two flavors of magic link:

Flavor	Used by	Expiry	Reuse
User-requested	Sign-in page and rewards login/join - you type your email and ask for a link	30 minutes	Single-use - second click fails with "This link has already been used"
System-generated	Release emails, invitation emails	30 days	Multi-use - you can click the same link multiple times until expiry, useful for returning to a release or completing setup later

Magic-link rules:

• User-requested links: maximum of 3 per email per 15-minute window; over-limit requests are silently dropped.
• All magic-link tokens are stored hashed (never in plaintext).
• Multi-use system links remain valid as long as your email and intended destination haven't changed; if the merchant cancels the release or invitation, the link no longer works.
• If the email isn't tied to an existing account, signing in with a magic link creates the account on the spot using the name/phone/birthday provided in the link's context.

Add your card links are not sign-in links. A business can email you an Add your card link. It opens a page where you add a card without signing in, and it works for as long as the business has set (72 hours unless they change it, never more than 30 days). If it has expired, open it anyway and click Send me a new link: a new link goes to the email address the business has on file for you, at most once every 10 minutes and 3 times a day.

All authentication is email-based. There is no social login (Google, Apple, etc.).

---

Passwordless Accounts

Some MemberZone accounts have no password at all - for example, accounts created from a magic-link sign-in or a member invitation where the user never went through a traditional signup form. These accounts work normally and can sign in by:

• Asking for a magic link on the sign-in page, or clicking a link a business emails them
• Setting a password from Change Password on their profile once signed in (see below)

When an account needs a password set, a Set your password sidebar opens after signing in: "Sign in directly next time. Magic links from your email keep working too." Enter a New password and Confirm password; a strength meter shows what's missing. A password needs at least 8 characters and at least 3 of these: 8 or more characters, an uppercase letter, a lowercase letter, a number, a special character. Click Not now to skip it for this session.

---

Multi-Role Accounts

The same email address can have both business and member roles. When you log in, a business account goes to HQ. To reach your memberships, open the menu under your name and click Member portal.

---

Password Management

Changing Your Password

You can change your password from your profile while signed in:

1. Open the menu under your name and click Profile (/member/profile)
2. Next to your password, click Change
3. In Change Password, enter your New Password and Confirm New Password
4. Click Update

You aren't asked for your current password, so this also works for an account that has never had one.

Setting Your First Password

Accounts created for you (guest checkout, an invitation, a business adding or importing you, or a magic-link signup) start without a password. After you sign in, MemberZone shows Set Your Password: enter a New Password, Confirm Password and click Set Password. You can close it, but it comes back in your next session until you set one.

Forgot Your Password?

There is no password reset link. Sign in with Send me a magic link on the sign-in page instead, then set a new password from Change Password on your profile.

---

Your Profile

Both business owners and members can manage:

• Name - Displayed across the platform
• Email - Used for login and notifications
• Phone number - Used for contact and loyalty lookups at POS
• Birthday - Used for age verification where required. If it's missing when you order from a business that sells alcohol, cigars or cannabis, its store checkout asks for it once and saves it here

---

Addresses

You can save multiple addresses with labels (e.g., "Home", "Office"). One address can be marked as default for shipping. Addresses include street, apartment/unit, city, state, zip code, and country.

Business owners can also add and manage addresses on behalf of their members when needed (e.g., during CRM import or when helping a member update their info).

---

Age Verification

Businesses that sell alcohol, cannabis or tobacco, and programs whose tier requires age verification, check your date of birth when you join or order. The age depends on the business's country: 21 everywhere in the US; in Canada, the legal age in the province where you buy, pick up or have your order shipped (18 or 19 for alcohol, 18 to 21 for cannabis and tobacco, depending on the province). Creating an account itself only needs you to be 18 or older; each business then checks its own age.

For compliance, some flows may require identity verification. The verification status can be:

• Pending - Verification submitted, awaiting review
• Approved - Identity confirmed
• Declined - Verification failed

---

User Roles

• Business owner - Full access to the business dashboard and management features. Can add/remove team members, manage all settings, and deactivate accounts.
• Team member - Access determined by role-based permissions (RBAC) set by the business owner. Custom roles can be created with specific permission toggles.
• Member - Access to the member dashboard for managing memberships, orders, and rewards.

---

Account Security

• Passwords are securely hashed; the database column is nullable so passwordless accounts (magic-link-only users) are supported.
• Sessions are maintained via authentication tokens.
• Accounts created without a password are prompted to set one after signing in.
• User-requested magic-link tokens expire after 30 minutes, are single-use, and rate-limited to 3 requests per email per 15 minutes.
• System-generated magic-link tokens (release emails, invitations) expire after 30 days and are multi-use until expiry.
• Add your card links are signed links, not magic links: they don't sign you in, and they expire after the business's card link lifetime (1 hour to 30 days, 72 hours by default).
• Magic-link tokens are always stored hashed (never in plaintext) and tied to a single email address.