Logging in and resetting your password

Logging in

Go to /login. Enter the email and password you registered with. Hit "Sign in". You will land on your default surface based on account type:

• Students land on / (the home page).
• Mentors land on /mentor (the dashboard) if onboarding is complete, or /mentor/onboarding if not.
• Studios land on /studio similarly.
• Admins land on /admin.

Sessions are stored in an HttpOnly cookie. We do not use localStorage tokens (less surface for XSS attacks). The cookie is Secure in production and Lax SameSite, so it does not cross domains in a way that would let other sites impersonate you.

A session lasts 30 days from your last activity. Hit a page, the cookie's "last seen" gets bumped. Go a full month without using MoveMentors and you are silently logged out and have to re-enter your password.

Forgot your password

We do not have a fully self-serve password reset live yet (we are working on it). Until it ships:

1. 1

   Email support

   Send a note to support@movementors.com from the email address tied to your account. Subject "Password reset" is enough; we triage by subject during business hours.

2. 2

   Verify your identity

   We will reply asking for one or two non-public details from your account so we know it is really you (a recent booking, the city you signed up from, etc).

3. 3

   Get a temporary password

   We send a single-use temporary password. Log in with it.

4. 4

   Change it

   Go to /settings/security and set a new permanent password. The temporary one is invalidated the moment you do.

Self-serve email-based password reset is on the near-term roadmap. When it ships, this article gets rewritten and you will see a "Forgot password?" link on the login form.

Changing your password

Log in, go to /settings/security, and set a new password. You will need to enter your current password first as a guard against someone hijacking a session you left open.

Changing your password does not log you out of other devices. If you suspect someone else has your password, see "Logging out everywhere" below.

Logging out

The user menu in the top-right corner has a "Sign out" item. Click it. The session cookie is destroyed server-side (the token is invalidated, not just deleted from your browser) so a copy of the cookie cannot be replayed.

Logging out everywhere

If you think your password was leaked or used on a device you no longer control:

1. 1

   Change your password first

   This invalidates the credentials on every other device. They will fall off the next time the cookie tries to refresh.

2. 2

   Email support if you want everything invalidated immediately

   "Force logout all sessions" on your account. We can purge every active session in the database with a single SQL update. That kicks every browser out within seconds.

Security tips

• Use a password manager. We do not enforce minimum complexity beyond 8 characters because complexity rules push people toward predictable patterns. A 14-character random password from a manager is significantly better than Pa$$w0rd1234.
• Do not reuse passwords. If another site you used the same password on gets breached, attackers will try the credentials here.
• Two-factor authentication is not yet available. We will add it in a future release; until then, your best defense is a unique password.

Common login errors

"Invalid credentials" Either the email is wrong or the password is wrong. We do not tell you which because that would help attackers enumerate accounts. Double-check you are using the email you registered with.

"Email not verified" You signed up but never clicked the confirmation link. Check your inbox (and spam folder) for the email from support@movementors.com. The link expires after 24 hours; we can resend you a fresh one if you email us.

The page just reloads without an error Most commonly a browser extension is blocking the auth cookie. Try in a private window. If it works there, walk through your extensions one by one in a normal window to find the culprit.

"Too many attempts, try again later" We rate-limit login attempts to slow down credential-stuffing attacks. The throttle is per IP and per email; wait 15 minutes and try again.

Next steps

• Make sure your account is set up the way you want it. See notification preferences.
• Still cannot log in after trying everything? See I cannot log in for a fuller diagnostic.