Login and Access Issues

Targeted answers when you can't get into your Alphio account — beyond the password-reset basics.

---

I'm getting "Invalid credentials" but I'm sure my password is right. A few non-obvious causes are common here:

• The account may be OAuth-only (no password ever set) — try the Google / Apple / X button instead.
• The email field accepts an exact match — a different casing or a trailing space won't match.
• A previous password manager autofill may be inserting the password for a similar but different domain. Type it manually once.
• The account may have been registered with a different email than the one you remember (work vs personal). Check both inboxes for past Alphio emails.

If none of these work, use Forgot password and follow the reset flow. The reset confirms the email exists and you control it.

I can't receive the email verification code. Email delivery is the #1 cause of login friction:

• Wait 60 seconds, then check spam / promotions / "all mail".
• Whitelist the Alphio sender domain in your email provider's filters.
• Corporate / school inboxes often block transactional senders — try a personal email.
• Some providers (notably certain regional ISPs) delay or drop codes — switch to a Gmail / Outlook account if you have one bound.
• If the code still doesn't arrive after 5 minutes and several retries, contact support with the email you're trying to use and approximate timestamps.

OAuth sign-in fails with "permission denied". This usually means you previously revoked Alphio's access on the provider side:

• Google — Google Account → Security → Third-party access → find Alphio → re-grant.
• Apple — Settings → Apple ID → Sign in with Apple → Alphio → stop / re-enable.
• X (Twitter) — Settings → Security and account access → Apps and sessions → reconnect Alphio.

After re-granting, retry from the Alphio sign-in page. If the same error returns, clear the browser's cookies for both the provider domain and alphio.ai and try once more.

My session keeps logging me out. Sessions are bound to several factors; any of them rotating logs you out:

• Browser cookies cleared — by you, by a privacy extension, or by Incognito / private mode.
• Long inactivity — sessions expire after an extended idle window.
• Suspicious activity — if the backend detects a risk signal (new IP geo, new device), sessions are revoked for safety.
• Password change elsewhere — changing the password invalidates all existing sessions.

If you're logged out repeatedly despite normal usage, contact support so we can check the revocation reason on your account.

How do I sign in on a new device? Use the same sign-in method as your existing device:

• OAuth account — click the same Google / Apple / X button on the new device.
• Email + password — enter email + password. If 2FA is enabled, you'll be prompted for the second factor.
• Some new-device logins trigger an email confirmation for safety — approve from your inbox to complete the login.

Active sessions across devices can be reviewed under Settings → Security → Active sessions, and revoked one at a time.

Two-factor authentication setup.

warning

The full 2FA / TOTP setup flow is still rolling out and may not be available on every account yet. If Settings → Security → Two-factor authentication is visible on your account, enroll via the in-app instructions (scan QR with an authenticator app, save backup codes in a safe place).

If the option isn't visible, 2FA is not yet enabled for your account. Use a strong, unique password and rely on OAuth provider 2FA in the meantime.

I lost access to my OAuth provider — how do I recover? Without the OAuth provider, you cannot complete the OAuth flow.

• If you can still log in to the provider via account recovery, restore that first (Google / Apple / X all have their own recovery flows). Once you're back in, Alphio login will work.
• If the OAuth account is permanently lost, contact Alphio support with as much account-identifying info as you can provide (registered email if you remember, approximate signup date, last actions, payment method on file). Recovery is manual and case-by-case — we cannot guarantee success.
• After recovery, consider binding a backup sign-in method to the same account.