Authentication: Login, Registration, Social Login & Password Reset
Overview
The Rate Payer Portal supports multiple authentication methods: email/phone login with password, social login via Google, Microsoft, or Apple, OTP verification for new or unverified accounts, user registration, and a forgot-password flow with OTP reset.
Navigate to: /auth/login
Login Screen
The login screen accepts credentials via email or phone number, with a password field and social login options.
| Field | Required | Notes |
|---|---|---|
| Email or Phone Number | Yes | Accepts email address or phone number |
| Password | Yes | Show/hide (eye) toggle |
Actions:
| Element | Description |
|---|---|
| LOG IN button | Submits credentials to POST /web/ratepayerlogin |
| Forgot Password? link | Opens the Forgot Password flow |
| Google button | Opens Google social login popup |
| Microsoft button | Opens Microsoft social login redirect |
| Apple button | Opens Apple social login popup |
| Don't have an account? Sign Up | Links to Registration |
!!! tip "Things to check" - Invalid credentials show a clear error message, not a silent failure - Password field masks input by default and toggles visibility correctly - Social login buttons (Google, Microsoft, Apple) each initiate the correct OAuth flow - Forgot Password? starts a working reset flow - Sign Up correctly routes to the registration page
OTP Verification
If the backend returns verified === 0 after login, the user is shown an OTP
verification screen.
| Element | Description |
|---|---|
| 6-digit code input | One digit per box, OTP sent to the registered email/phone |
| Countdown timer | 180 seconds (3 minutes) before resend is available |
| Resend OTP link | Re-sends the OTP after the countdown expires |
| Verify button | Submits the OTP for validation |
| Cancel button | Returns to the login screen |
The OTP is submitted as part of the login request: POST /web/ratepayerlogin
with {email/phone, password, code}.
!!! tip "Things to check" - Entering an incorrect OTP shows a clear error and allows retry - Verify button stays disabled until all 6 digits are entered - Resend OTP is disabled during the 180-second countdown - After successful verification, the user is logged in and redirected to the dashboard - Cancel returns to login without side effects
Registration
Navigate to: /auth/register
New users register as either an Individual Rate Payer or a Company/Organization.
Choose Registration Type
| Option | Description |
|---|---|
| Individual Rate Payer | For personal property registration and single or multiple ownership |
| Company/Organization | For business entities, corporations, and institutional rate payers |
Path A: Individual Rate Payer
Step 1 — Personal Info:
| Field | Required | Notes |
|---|---|---|
| First Name | Yes | |
| Middle Name | No | |
| Surname | Yes | |
| Identification Type | Yes | Dropdown, defaults to Ghana Card |
| ID Number | Yes | Placeholder format GHA-XXXXXXXXX-X |
| Date of Birth | No | Date picker |
| Gender | No | Dropdown |
Step 2 — Contact Info & Account Setup:
| Field | Required | Notes |
|---|---|---|
| Contact Number | Yes | Country code selector (defaults +233 Ghana) + number |
| Email Address | No | |
| Password | Yes | Strength meter with 4 rules: at least 8 characters, upper & lower case, at least one number, at least one symbol |
| Confirm Password | Yes | Must match Password |
Submit stays disabled until all required fields and password rules are satisfied.
Path B: Company / Organization
Step 1 — Organization Info:
| Field | Required | Notes |
|---|---|---|
| Organization Name | Yes | Legal name |
| Organization Type | Yes | Dropdown |
| Registration No | Yes | e.g. CS123456789 or BN0001234... |
| TIN Number | Yes | e.g. TL/AMA/2024/012345 |
| Sector / Category | Yes | Dropdown |
Step 2 — Account Setup:
| Field | Required | Notes |
|---|---|---|
| Contact Number | Yes | Country code selector + number |
| Email Address | Yes | Required here — unlike Individual, where it's optional |
| Password | Yes | Same 4-rule strength requirements |
| Confirm Password | Yes | Must match Password |
A Upload your Documents section follows for supporting documents.
!!! tip "Things to check" - Individual: Email is optional; Company: Email is required — confirm both enforce this - Password strength meter updates live and all 4 rules are enforced - Confirm Password flags a mismatch before Submit is attempted - Registration type choice does not leak fields from the other path - Successful submission either logs the user in or redirects to login
Forgot Password
Navigate to: /auth/forgotpassword
A 2-step flow: enter email/phone → verify OTP → set new password.
Step 1 — Enter Email or Phone:
| Field | Required | Notes |
|---|---|---|
| Email or Phone Number | Yes | The registered email or phone for the account |
POST web/forgotpassword sends an OTP to the provided contact.
Step 2 — OTP Verification & Reset:
| Field | Required | Notes |
|---|---|---|
| 6-digit OTP code | Yes | Sent to the email/phone |
| New Password | Yes | Same strength rules as registration |
| Confirm New Password | Yes | Must match |
POST web/resetpassword completes the reset.
!!! tip "Things to check" - An unregistered email/phone shows a clear error - OTP expires after a reasonable window and expired codes are rejected - New password is validated against all strength rules - After successful reset, the old password no longer works - User is redirected to login after a successful reset
Social Login
Google Login
Navigate to: /auth/google-login
Opens a Google OAuth popup. On successful authentication, the callback redirects to the dashboard. If the Google account is not linked, the user may be prompted to complete registration.
Microsoft Login
Navigate to: /auth/microsoft-login
Opens a Microsoft OAuth redirect flow. On success, redirects back to the portal with an authenticated session.
Apple Login
Navigate to: /auth/apple-login
Opens an Apple OAuth popup. On success, the user is authenticated and redirected to the dashboard.
!!! tip "Things to check" - Each social login (Google, Microsoft, Apple) completes the OAuth flow without errors - New users via social login are prompted to complete their profile/registration - Returning users via social login are logged in directly - Cancellation or failure during OAuth shows a clear error, not a blank screen - Session established via social login persists across page refreshes
Session Management
After login, the session is validated via GET /web/authuser. The session
persists in the browser until the user logs out or the token expires.
Logout: POST /web/logout — clears the session and redirects to the
login page.
!!! tip "Things to check" - Refreshing the page after login maintains the session (no re-login required) - Navigating to a protected route without a valid session redirects to login - Logout clears all session data and redirects to the login screen - Expired sessions redirect to login with a clear message