Skip to documentation
OneClickRooms Documentation OCR for Higher Education
/
Get Started

Secure account setup and password recovery

OCR for Higher Education is the university product in OneClickRooms (OCR) for Education. The other product is OCR for Schools.

Use invitation links and forgot-password recovery without sending passwords through email.

Institution Admin Campus Admin Faculty Student 3 min read Updated
Portal path Dashboard Sign in and navigation Account security

OCR for Higher Education uses a setup-link workflow so a password is created by the user in the browser rather than transmitted in an email.

Use the single-use setup link and sign in after completion

  1. Open the setup link

    Select the time-limited link in the invitation or password-reset email. The link is single-use and should not be forwarded.

  2. Create the password

    Enter and confirm a new password on the browser page. After successful setup, the user is redirected to the login page and signs in with the new password.

  3. Request recovery carefully

    Use Forgot Password only when needed. Requests are rate-limited by IP and email to reduce automated abuse; repeated requests may temporarily block further attempts.

Never email or share a password

Support staff should issue a new setup link rather than asking for, receiving, or sending a user password.

Recovery throttling

A single IP is limited to one forgot-password attempt in a five-minute window. Five attempts in the rolling protection window trigger a temporary ten-minute block, and ten attempts within the larger protection window trigger a one-hour IP block. An email address also receives a cooldown so repeated requests do not generate unlimited active links.

Expired Superadmin sessions

A Superadmin session status of 2 means PHP considers the session active, but an empty session-key list means the authenticated Superadmin payload is no longer present. This commonly occurs after expiry or session rotation. The secure behavior is to clear the stale session and return to Superadmin sign-in; internal session names, IDs, and debug keys must never be shown to users.

Administrator-initiated password resets

An authorized administrator can request a reset from the relevant record action menu. A user can also request a reset for their own account from the profile menu. The portal sends a time-limited, single-use setup link directly when the request is confirmed; the email never contains a password. The recipient chooses a new password on the secure portal page. The link is valid for 24 hours.

A faculty member can reset the account password even before accepting an employment contract; contract acceptance and password recovery are separate workflows. If delivery fails, the portal shows a concise error rather than raw server output. If the email is not found, check spam, confirm the address and mailbox are active, and ask the institution email administrator to check provider delivery status.

Recommended next step

If the link has expired or was already used, request a new one from the relevant account workflow.