Signing in and security

1. Open the sign-in page for your website and enter your username and password.
2. If you have a second step set up, complete it. Select Use your passkey, or enter the 6-digit code from your authenticator app.

• The form runs an invisible bot check when you submit it. There is nothing for you to do.
• If you have a passkey, you can also sign in with the passkey alone from the sign-in page.
• A sign-in on the web lasts 7 days. After that, you sign in again.
• To sign out, select Log out in the top bar.

A second step is optional. When you sign in with only a password and have no second step, a Secure your account prompt offers Set up a passkey, Use an authenticator app or Not now.

MeridianOS™ counts failed sign-in tries over 15 minutes and pauses sign-in when a limit is reached.

At the limit, the form shows Too many sign-in attempts and the number of minutes to wait before you try again.

The network limit counts every failed try from the same network address, whichever username was typed.

Select the shield icon in the top bar to open the Security page. Its opening line reads Manage how you sign in to your account. Admins and employees get the same page.

1. Open the Security page from the shield icon in the top bar.
2. Under Password, select Change.
3. Enter your current password.
4. Enter a new password. A live checklist marks each rule as you meet it.
5. Save the new password.

A new password has to meet every rule on the checklist:

• At least 12 characters
• 1 uppercase letter
• 1 number
• 1 special character

• You cannot reuse your current password.
• The same rules are checked again when the password is saved, so a password that fails the checklist is refused.
• In the MeridianOS™ app, Change password is under Security in Account.

Changing your password signs out every other device on your account. That includes the MeridianOS™ app on your other devices.

Two-factor authentication adds a 6-digit code from an authenticator app as a second step at sign-in.

1. Open the Security page and go to Two-factor authentication.
2. Scan the QR code with your authenticator app, or enter the manual setup key in the app.
3. Enter the code the app shows to verify the setup.

• After setup, the sign-in form asks for a code after your password.
• Turning two-factor off also needs a current code from the app.
• In the MeridianOS™ app, you can set up two-factor with a QR code under Security in Account.

If you are an admin and lose access to your authenticator app, text or email Stack Digital to have two-factor authentication reset. For an employee, an admin can use Reset 2FA on the employee's page. See Employees and permissions.

A passkey lets you sign in with Face ID, Touch ID, or a security key. You can use it by itself from the sign-in page, or as the second step after your password. Passkeys also count as a second factor.

• You can have more than one passkey, and each one has a name.
• The list shows the date each passkey was added and when it was last used. A passkey can also carry a Synced label.
• You can rename or remove a passkey.
• You add a passkey on the web. In the MeridianOS™ app, Security in Account lists your passkeys and lets you remove them.

There are two admin roles, admin and super admin. Stack Digital holds the super admin account for your site and manages admin accounts on the Admins page, which appears only for a super admin. To add an admin, remove one or reset an admin sign-in, text or email Stack Digital at support@stackdigital.com. The page lists each admin account with Username, Email, Role, 2FA and Created, and offers these actions.

• A super admin account can only be changed by its owner.
• The super admin role cannot be granted from the page.
• MeridianAI cannot create admins or change passwords, two-factor or passkeys.
• Because the page is for the super admin, Admins does not appear in your own menu.

The MeridianOS™ app for iPhone, iPad and Mac uses the same username and password as the web. Your account decides whether you get the admin screens or the employee screens.

1. On the welcome screen, select Sign in to your dashboard.
2. Enter the website address of your business. Your sign-in lives at that address. If the address is not a MeridianOS™ site, the app says it could not find a dashboard there.
3. Enter your Username and Password. Passwords saved on your device can fill the form.
4. If two-factor is on, enter the 6-digit code from your authenticator app. The code submits itself at six digits.

Depending on your site, the passkey button reads Sign in with a passkey or Use passkey or saved password. The second one finishes sign-in in a private browser window. A passkey can also be your second step, with Confirm with your passkey.

• When you come back, the app says you are still signed in and offers Continue as with your name, or Sign in with a different account.
• Every site you sign in to is saved with its logo under Your sites, and each site keeps its own sign-in. Switch site is in Account. Forget this site removes one.
• The app session lasts 90 days and is extended automatically while you use the app.
• Sign-in details are stored securely on that device only.
• The app rechecks your access when you return to it and on a timer, about every minute for employees and every five minutes for admins. If your access was removed, it signs out at once and shows Sign in again. Your session on this site ended.
• A deactivated employee cannot sign in.

The app locks after 5 minutes away and on every fresh launch. You open it again with Face ID, or with Touch ID or your device passcode, depending on the device.

• The setting is Require Face ID in Account. The name follows what your device supports, such as Touch ID or a passcode.
• The lock is on by default. You can turn it off in Account.
• The lock screen also offers Sign out.