Signing in and opening an account
Six screens sit outside the console, before you are signed in. They are the ones people meet first and the ones support is asked about most, so each is described here in full.
One sign-in, any number of accounts
Section titled “One sign-in, any number of accounts”You sign in as yourself, with your email and password. Whatever accounts you have a seat in — your own business, a second business, a client you build for, another app or brand of the same company — all open from that one sign-in.
| Belongs to you, across every account | Belongs to each account |
|---|---|
| Email and password | API keys, balances, transactions, settlements |
| Two-factor authentication and recovery codes | Webhooks, settlement destinations, settings |
| Lockout after wrong passwords | The team, and your role in it |
So you set up two-factor once, change your password once, and are an owner on one account and a developer on another without either knowing about the other.
Every account still has an account code — a short permanent identifier like
ACME01, allocated when the account was opened. You no longer need it to sign
in. It is shown in Settings → Business → The account, beside the account name
in the sidebar, and on your statements, and it is the quickest way to tell support
which account you mean.
Opening an account — /signup
Section titled “Opening an account — /signup”Two steps, and nothing is submitted until you finish the second, so the first cannot half-create anything.
Step 1 — the business
Section titled “Step 1 — the business”| Field | Required | Notes |
|---|---|---|
| Trading name | Yes | What your customers call you. It is what they will see on their statement. |
| Registered name | Yes | The name on your registration documents. Verification is checked against this, so get it exactly right. |
| How is it registered | Yes | Limited liability company, Sole proprietorship, Individual / freelancer, Partnership, NGO or non-profit, Government body. |
| Country | Yes | Ghana, Nigeria or Kenya. This sets your settlement currency — GHS, NGN or KES — and the currency cannot be changed afterwards. |
| Business phone | Yes | With the country code: +233 20 000 0000. |
Step 2 — you
Section titled “Step 2 — you”| Field | Required | Notes |
|---|---|---|
| First name / Last name | Yes | You become the owner of the account. |
| Your email | Yes | This is what you sign in with. It can differ from the business contact address. |
| Password | Yes | At least 12 characters. The API enforces its own complexity rules on top of that. |
| Password again | Yes | Checked in the browser, because a typo in a password nobody can read back locks you out of your own account. |
What you get, and what you do not
Section titled “What you get, and what you do not”The confirmation screen shows your account code. You do not need it to sign in, but it is how you name this account to support.
The account arrives pending:
- Test environment only. The live switch is disabled.
- No API keys and no pricing on file. Nothing can be collected until a rate card is set.
- Real money needs a verification review by a person. See Verification.
Signing up with an email you already use
Section titled “Signing up with an email you already use”If Your email already signs in to PaySigna, the new business is added to that sign-in rather than creating a second login. Enter your existing password in the password fields — it is checked, never replaced. A wrong password is refused with “This email already signs in to PaySigna. Enter that password to add this business to your sign-in, or reset it if you have forgotten it,” and counts towards the lockout.
Once it succeeds, the new business appears under Switch account in your account menu.
Signing in — /sign-in
Section titled “Signing in — /sign-in”Email and password. If you have two-factor authentication on, a code field appears once those are accepted.
| Field | Notes |
|---|---|
| Account code | Optional. Leave it blank to open the account you used most recently. Fill it in to go straight to a particular account you have a seat in. The portal no longer remembers it between visits. |
| Your own address, not the business contact address. | |
| Password | The same password for every account you hold. |
| Code from your authenticator | Six digits. Or one of your recovery codes — choose I no longer have my authenticator. |
A refused authenticator code is almost always a clock problem: set your phone’s time to update automatically and try the next code.
Your session is sealed into an httpOnly cookie by the portal’s own server. The tokens never reach the page, which is why a sign-in cannot be scraped out of the browser by anything running in it.
Signed-in sessions are listed, and revocable, under Settings → Your account → Signed-in devices.
Too many wrong passwords
Section titled “Too many wrong passwords”Five wrong passwords in a row lock your sign-in for 15 minutes — for every account you hold, because it is one sign-in. Wrong existing-password attempts on an invitation or a sign-up count towards the same five.
Switching account
Section titled “Switching account”Open the account menu — your initials, top right. Your other accounts are listed under Switch account, each with its code and your role there. Choosing one opens the console in that account; you are not asked for your password again.
Owners and admins can also switch from Account → Accounts, which lists every account in the organisation — see Accounts.
What switching does, exactly:
- The session belongs to one account at a time. Switching starts a new session on the other account and ends the one you were in. Nothing on screen ever mixes two accounts’ data, and no page acts on “all my accounts”.
- Your role changes with the account. You see the sidebar, and hold the permissions, of your role in the account you are in.
- The environment switch is per browser, so if you were looking at test data you will still be in test after switching. Check the switch before reading a figure.
The account you are in is always named at the top left of the console, with its code beneath it.
Being made to change your password — /change-password
Section titled “Being made to change your password — /change-password”If an administrator or the platform has flagged your password for replacement, every route into the console redirects here until you do it. The console is not reachable in between, by design — your session works for this one change and little else.
| Field | Notes |
|---|---|
| Current password | The one you just signed in with. |
| New password | The API enforces its own length and complexity rules. |
| New password again | Checked here, not by the server. |
It signs you out when it succeeds — everywhere. Your password is shared by every account you hold, so changing it ends your sessions on all of them, on every device. That is deliberate rather than a glitch: the change does not issue a new session, so the only honest end to the flow is to sign in again with the new password — which also proves it works.
The same screen is reachable voluntarily from Settings → Your account → Password.
Forgotten password — /forgot-password
Section titled “Forgotten password — /forgot-password”Two steps.
Step 1 asks only for your email, and then says the same thing whether or not that address signs in to PaySigna. That is not unhelpfulness: an honest “no such user” here would let anybody walk a list of email addresses and learn which businesses bank with us. A wrong address fails by the code never arriving.
Step 2 takes the reset code from the email, a new password and a confirmation of it.
The new password is the one for every account you hold. Resetting it signs you out of all of them on every device, and any other reset or invitation code still outstanding for your address stops working.
If no code arrives: check the address is your own sign-in address rather than a business contact address, and check spam. If you cannot recover the address at all, that is a support conversation — nobody in the portal can do it for you.
Accepting an invitation — /accept-invitation
Section titled “Accepting an invitation — /accept-invitation”The link in a team invitation lands here with the code already on it; otherwise paste the invitation code from the email. Separators and case do not matter.
The code is checked before you are asked for a password, so a dead link tells you so immediately instead of after you have chosen and confirmed one. An invitation lasts 48 hours and there is no resend — if it has lapsed, ask whoever invited you to invite you again.
What comes next depends on whether you already sign in to PaySigna with the invited address:
- New to PaySigna — Choose a password (at least 12 characters) and confirm it. That becomes your sign-in. You have no password until this succeeds, so a half-finished acceptance leaves nothing behind; just start again with the same code if it is still live.
- You already sign in with this email — Enter your PaySigna password: your existing password, once. The business that invited you is added to your sign-in and appears under Switch account. An invitation never changes the password of somebody who already has one. Forgotten it? Reset it from the sign-in page, then come back to the invitation while it is still live. Wrong attempts count towards the lockout.
Either way, accepting confirms your email address: the code reached you there. You are never asked to confirm it separately.
Confirm your email first — /confirm-email
Section titled “Confirm your email first — /confirm-email”You must confirm your email address before you can change anything. Until
you do, you can sign in, read every page, and manage your own sign-in: sign out,
sessions, password, two-factor, switching account and asking for a new code
(everything under /v1/auth). Every other change is refused with 403 forbidden: “Confirm your email address first. We sent a code to it when you
signed up; you can ask for a new one on the confirmation screen.”
The console sends an unconfirmed user to Confirm your email: “We sent a code to {email}. Enter it to start using your account.” It has a Confirmation code box (“From the email titled “Confirm your email address”. Separators and case do not matter.“), Send a new code, Sign out, and “Not arriving? Check your spam folder. A new code replaces the old one, so only the latest works.” If you confirm the address somewhere else, for example from the email link on another device, the screen notices and takes you into the console.
Accepting a team invitation confirms your address, since the code was emailed there, so invited teammates never see this screen. Users who signed up before this and never confirmed are sent here on their next visit.
Confirming your email — /verify-email
Section titled “Confirming your email — /verify-email”Paste the confirmation code from the email; separators and case do not matter. This screen needs no session at all, because the person clicking the link is often on a different device from the one they signed in on.
It ends at “that address is verified — now sign in”. It does not sign you in, and it cannot: confirming spends the code and issues no session.
A fresh code cannot be requested from here — there is nobody to send it to. An expired link says “Sign in: the confirmation screen sends a new one.” It is requested from inside the console, on the confirmation screen or at Settings → Your account → Email confirmation, where you are already known.
Signing out
Section titled “Signing out”Account menu → Sign out ends this session. Settings → Your account → Sign out everywhere ends every session you have, on every account and every device, including the one you are using — the right move if a device has been lost.
Signed out automatically
Section titled “Signed out automatically”After 15 minutes without activity. Activity means a click, a key, a scroll or a touch. A page refreshing its own data does not count. A minute before the limit, a dialog asks “Are you still there?” and counts down. Choose Stay signed in to carry on, or Sign out now. Every tab you have open shares the same clock, so working in one tab keeps the others signed in. Signing out in one tab signs out all of them. The limit is also checked on our side on every request. So a laptop that was closed, or a browser that reopened its tabs after a restart, is signed out too. The sign-in page then says “You were signed out after a period without activity.”
When you close the browser. The session ends with the browser. A browser that restores your tabs on restart can carry a session over, but the 15-minute limit still applies to it.