Email & Password Login

Email and password authentication is the foundational access layer that enables every other platform capability - no user can register activities, manage contacts, or run reports without first being able to sign in. It is the only credential method that is universally available, works without third-party dependencies, and carries no per-month licensing cost. Launching with email/password lets the platform reach all five partner organisations on schedule while BankID and Vipps - which require Norwegian certification processes and shared cost negotiations - are prepared in parallel. Reducing authentication risk at launch is essential given that all four real organisations must migrate from existing Word/Excel workflows simultaneously.

Built inside the Authentication Module (Product 3), which must stay decoupled and extractable into a standalone service at any time. Passwords stored as bcrypt hashes with appropriate cost factor; plaintext never written to logs or database. The module issues short-lived JWT access tokens and rotating refresh tokens; the mobile app stores tokens in flutter_secure_storage while the admin portal uses HTTP-only cookies. Password recovery sends time-limited single-use tokens via transactional email. The sign-in contract (sign-in, sign-out, refresh, identity lookup) must be stable so BankID and Vipps providers can be added later without forcing consumer changes.