Accepting An Invitation

When someone makes an account for you on GeoHazardWatch, they can send you an invitation instead of a password. The invitation is an email with a link. You use it to choose how you will sign in, so nobody else ever knows your password.

Using the Link

1 Open the link in the email. A page says who the account is for and shows your username.
2 Click Continue. You are signed in, this once, by the link itself.
3 If the site has terms for you to read, you are asked to accept them first.
4 You arrive at Set up your sign-in. Choose a password and type it twice, then click Set my password. If the site offers passkeys, you can add a passkey from your profile instead, or as well.
5 Click I'm done. From now on, sign in with your username and the password or passkey you chose.

Things to Know

The link works once. After you have used it, opening it again says it has already been used. Sign in as usual instead.
The link does not last forever. The email says until when it works, shown in your own time zone. After that it does nothing, and you ask the person who invited you to send a new one.
A new invitation replaces the old one. If you are sent another invitation, only the newest link works.
Opening the link changes nothing until you click Continue. Some email systems check links before you see them; that does not use up your invitation.
Not expecting it? If you did not expect an account here, ignore the email. Nothing happens unless you use the link.

Your Recovery Words

If the site keeps encrypted private stores, the setup page tells you so. The first time you open an encrypted store, you are shown 12 recovery words, once. Write them down and keep them somewhere safe, away from this device. If you forget your password, the words are the only way back into your encrypted pages: nobody else, not even an administrator, can open them for you. See Password Management Guide.

If the site keeps no encrypted stores, you have no recovery words to keep.

For Administrators

Sending an invitation: in User Management, tick Send an invitation instead of setting a password when you create the account. The account needs an email address. The list then shows the account as Invited, with the date the link stops working, until the user first signs in.
Resending or cancelling: an account with no password that has never signed in has Send invitation (or Resend invitation) and Cancel invitation buttons in the list. Resending sends a new link; the old one stops working. Cancelling makes the link stop working.
How long a link works: 7 days unless you change ngdpbase.auth.invitation.ttl-days in Admin Configuration.
Who can send them: anyone who may create accounts.
When email is not working: invitations need email to be set up and working, and the site's own address to be set. When they are not, the screen says so, no invitation is sent, and you can set a password for the account yourself on its edit page instead.
Every invitation sent, used, cancelled and expired is recorded in the audit log.