Why does the Portal keep signing me out?
The Portal session is idle-based, with an absolute ceiling:
When the session is gone, requests come back as
Session expired. and the Portal returns you to
the sign-in screen. There is no way to lengthen these windows from the Portal.
Two other things end a session immediately, before any timer:
- your account being locked after repeated wrong passwords (see below);
- your role being changed by an administrator — see Merchant Portal Operations.
How long is each email link valid?
Four different emails carry four different links, and their lifetimes are not the same. This is the single most common source of “the link says it expired” tickets.
An expired or already-used link does not silently fail — you get a specific message:
In every case the fix is the same: request a new one. Nothing is lost — the link only proves it is
you, it does not carry your data.
I asked for a new link and nothing arrived. Why?
Because there is a short per-minute cap on these emails, and hitting it returns a message rather than a mail:
Reached the message send times limit, please try again later.
The cap is counted separately for password resets and for invitation / sign-up-activation emails.
Resending the activation link uses the same budget as invitations.
So if you clicked Resend several times in a row, the later clicks were refused and the earlier
mails are the ones in flight. Wait a minute, then request once and check:
- the spam / junk folder;
- that the address is the one your administrator actually invited;
- that your mail server is not quarantining external senders.
Pending.
What are the password rules beyond complexity?
Merchant Portal Operations covers the complexity requirement. Three further rules decide whether a password change is accepted at all:
The messages map one-to-one:
The reuse check runs both when you change your password while signed in and when you set one
through a reset link, so cycling back to an old password is not possible in either path.
The Portal forced me onto a “set a new password” screen. What happened?
Your password reached its 90-day expiry. Sign-in succeeds but returns:
Your password has expired. Please set a new password for enhanced security.
and the Portal routes you to a forced password-change screen. This is not skippable — no other
Portal page will load until the new password is set. The new password must satisfy the format rule
and must not repeat your last three, so have a fresh one ready. Setting it also restarts the
90-day clock.
Password-based sign-in is what triggers this. If you signed in through Google, the expiry check
does not stand between you and the Portal — but your password stays expired for password sign-in
until you change it.
My account is locked. How long, and what unlocks it?
Wrong-password attempts are counted for one hour. The fifth failure inside that window locks the account:
Two consequences worth knowing:
- The counter only runs on accounts that are currently
Active, so failures against an account that is alreadyPendingorLockeddo not stack further penalties. - A successful sign-in clears the counter, so four failures followed by a success leaves you with a clean slate rather than one attempt remaining.
Which account statuses exist, and which can sign in?
Only one status can sign in. The rest each produce their own message:
In Settings → Members, your team list labels the first two —
Pending and Active — because
those are the two states an invitation flow produces. A row showing anything else is an account
that can no longer sign in, and only an administrator can act on it.
User disabled. is therefore not a bug report: it means the account exists but is no longer in a
state that permits sign-in. Contact an administrator on your merchant account rather than
retrying.
What does “Continue with Google” do?
It sits on both the sign-in and the sign-up screen. Clicking it opens Google’s own consent window; Waffo never sees your Google password. What happens next depends on what already exists:
Two rules always apply:
- Google must report the address as verified. An unverified Google address is rejected.
- The status check above still runs. Google sign-in does not bypass a locked or non-active account.
Why does the sign-up form make me pass a “security check”?
Self-serve sign-up sends a real email to the address you type, so the first send is protected by a human-verification challenge. If it does not pass you get:
Security check failed. Please refresh and try again.
Refresh the page and submit once — a stale page is by far the most common cause, because the
challenge is only good for a short time. The check runs on the send that starts sign-up, not on
every subsequent step.
What is the invitation code field on the sign-up form?
It is optional. Leave it empty and sign-up proceeds normally. If you were given a code and it is not accepted, the message is:
The invitation code is invalid.
Codes are exact — no leading or trailing spaces, correct case. If it still fails, ask whoever gave
it to you rather than guessing, and note that removing the code lets you register anyway.
I tried to sign up but the address already has an account.
You getEmail already exists. and no second account is created. One email address maps to one
Portal user, so:
- if you set a password before, sign in with it;
- if you never finished the invitation, use the invitation link, or ask your administrator to resend it;
- if you do not know the password, use Forgot password — that works on an existing account regardless of how it was created.
Can I choose the link or a code when signing up?
Yes. Self-serve sign-up supports two ways of proving you own the address:
Both prove the same thing, so pick whichever your mail setup handles better — the link path is
easier when mail arrives on the same device, the code path when it does not. Either way the
account is created once, and the per-minute send cap applies to both.
Sign-in worked, but the Portal says my user is not attached to a merchant.
The message is:
User not set relation merchants. Please contact your administrator to set the relation merchants.
Your credentials are fine; the account simply is not associated with a merchant account yet, so
there is no data for it to open. Only an administrator can attach it. This most often appears
right after an account is created outside the normal invitation flow.
Does the Portal ask for a verification code at every sign-in?
Only if two-step verification is switched on for your user. That, including the case where it appears without you enabling it and what to do when the code does not arrive, is covered in Merchant Portal Operations and Portal Self-Service Security Configuration. For sizing expectations here: the code is delivered by email, is short-lived, and resending it is rate-limited in the same spirit as the link emails above — repeated clicks returnOTP rate limit exceeded. rather than more messages.