Registration methods
- Email + password.
- Mobile number + OTP (SMS or WhatsApp) — recommended for the Saudi market.
- Google and Apple sign-in (Apple sign-in is required on iOS when social login exists).
Fields: full name, mobile (+966), email, password, acceptance of terms and privacy policy.
Sign-in: one form for every role; after authentication the user is routed by role.
Features
- Password reset by email or OTP.
- Email and mobile verification.
- Two-factor authentication: optional for trainees, mandatory for admins.
- Rate limiting on failed attempts, with a temporary lockout.
- Session and device management, with the ability to end sessions from “My account”.
Payment is not activation
Returning from the payment provider's page does not activate a subscription. Activation happens only after a signed webhook is verified. See Payments & invoices.