TutorCat Guide Open TutorCat

Admins

Signing in and your 30-minute session

Sign in with your email, password and a six-digit authenticator code. Sessions last 30 minutes.

On this page
  1. Before your first sign-in: set up your authenticator
  2. Sign in
  3. If sign-in is refused
  4. Your 30-minute session
  5. Sign out
  6. Lost or new phone

Admin sign-in needs three things: your email, your password, and the six-digit code from your authenticator app. There is no reset by email.

During the beta: the authenticator code is switched off, so the sign-in screen shows only email and password. Keep your authenticator set up: the code comes back when the beta ends, with no new setup needed.

Before your first sign-in: set up your authenticator

Admin accounts cannot be created from the console or by signing up. Engineering creates your account for you.

  1. When engineering creates your account, you type your own password at their prompt. It must be at least 12 characters. Use it only for TutorCat, and do not tell it to anyone.
  2. Engineering gives you a one-time setup link that starts with otpauth://. It is shown once only.
  3. Load it straight away into an authenticator app on your own phone. Any standard authenticator app works: add an account and paste the link or the key it contains.
  4. Check that the app now shows a TutorCat code that changes every 30 seconds.
  5. Delete any copy of the setup link from chat or email. Anyone holding it can make your codes.

Sign in

  1. Go to tutorcat.ai/admin. You see Admin sign-in.
    The admin sign-in screen with email, password and six code boxes
    1. Your admin email
    2. Your password
    3. Six-digit authenticator code
    4. Sign in
  2. Type your Email and Password.
  3. Open your authenticator app and type the current code into the six boxes under Authenticator code. You can paste it; spaces are removed for you.
  4. Select Sign in.

The console opens on Overview. If you opened a deeper link (for example /admin/invites) before signing in, you land there instead.

If sign-in is refused

You see Sign-in refused. Check your email, password, and authenticator code, then try again. The code boxes clear.

The sign-in screen after a refused attempt
  1. Same message for any mistake
  2. Wait for a fresh code

The message is the same whatever was wrong, on purpose: it never tells anyone which part was right.

  • Wait for the next code before trying again. Each code works only once, even within its 30 seconds.
  • The code from the previous 30 seconds is still accepted, so a slow phone clock is fine. Older codes are not.
  • If your phone's clock is far out, set it to automatic time.

If you see a message that Sign-in is unavailable because the server cannot open authenticator secrets, nothing you type will work. Tell engineering; it is a server setting, not your password.

Your 30-minute session

  • A session lasts 30 minutes from sign-in. It is not extended by activity.
  • The Session timer in the sidebar counts down (on a phone it sits in the top bar). It turns to a warning colour in the last five minutes.
  • For the last five minutes, a banner at the bottom of every page says Session expires in 4:59. and Sign in again after it ends to keep working.
  • When the timer reaches zero you return to the sign-in screen with Your admin session ended. Sign in again to continue.
  • There is no "extend" button. Sign in again with a fresh code.

The session lives only in that browser tab. Closing the tab ends it, which keeps a shared computer safe.

Sign out

Select Sign out at the bottom of the sidebar (on a phone, open the menu first). This ends the session in that tab.

Lost or new phone

You cannot move your authenticator yourself. Ask engineering to re-enrol you. You get a new one-time setup link, and the old authenticator stops working at once.