Skip to main content
The Login page is the primary security gate of the OwnPay platform. Only pre-registered staff members and the super-administrator can sign in. Brute-force protection and secure session management protect your financial data.

​
Access the login page

Open your browser and navigate to your OwnPay domain followed by the login slug:
The default slug is login, but you can customize it in branding settings for additional security through obscurity.

​
Login process

  1. Enter your registered email address or username
  2. Enter your password (case-sensitive)
  3. Optionally check Remember me to extend your session duration
  4. Click Sign In
  5. If 2FA is enabled, enter the code from your authenticator app (see Two-Factor Authentication)

​
Rate limiting

OwnPay enforces a login rate limit of 10 failed attempts per 5 minutes per IP address. After exceeding this threshold:
  • Further login attempts from that IP are blocked for 5 minutes
  • A warning message displays the remaining cooldown time
  • The attempt is logged in the audit log
Repeated lockouts from the same IP may indicate a brute-force attack. Review the audit log and consider blocking the IP at your server level.

​
Session management

Sessions are stored server-side in Redis. The session cookie is HttpOnly and SameSite=Strict to prevent cross-site attacks.

​
Concurrent sessions

By default, staff can be logged in from multiple browsers and devices simultaneously. You can view and terminate active sessions from My Account.

​
Login troubleshooting

Last modified on August 25, 2026

Related topics

Landing page configurationTwo-Factor AuthenticationFeatures and CapabilitiesPassword ResetRate Limiting