Secure Accounts

Every learner journey on Praxis924 starts with an account: it is what ties your progress, notes, bookmarks, and achievements to you across sessions and devices. This walkthrough covers the full account lifecycle — registering with email verification, logging in with JWT tokens, and recovering access if you forget your password. It is written for new learners signing up, and for admins who need to understand how their own accounts are provisioned differently.

What you'll need

A valid email address you can check (the verification link lands in your inbox).
In production, a working SMTP configuration on the server so the platform can actually send mail. In local development, if SMTP isn't configured, the verification link is written to the backend logs instead of emailed — so you can still complete the flow without a mail server.
Nothing else. Registration is self-service; you do not need an invite.

Note: Admin accounts are not created through the registration form. They are auto-seeded on startup from the ADMIN_EMAIL and ADMIN_PASSWORD environment variables. If you are setting up an instance, put your admin credentials in .env and the admin user appears the first time the backend boots.

Step 1 — Register

Open the app and go to the Register screen.
Enter your email and a password, plus any profile basics the form asks for.
Submit. Your account is created in an unverified state, and the platform sends a verification link to your email.

At this point the account exists but is not yet confirmed. The verification step proves you own the address before you rely on it for password recovery and notifications.

Step 2 — Verify your email

Open the email titled to confirm your Praxis924 account and click the verification link.
The link carries a one-time token that the backend validates; once accepted, your email is marked verified.

If you are running locally without SMTP, don't wait for an inbox that will never fill. Check the backend logs — the verification URL is printed there. Copy it into your browser to complete verification.

Tip: If the link looks expired or already used, just request a new one from the login screen and use the most recent email. Verification tokens are single-use.

Step 3 — Log in

Go to the Login screen and enter your verified email and password.
On success you receive two tokens: a short-lived access token (15 minutes) and a longer-lived refresh token (7 days).

The access token is what authorizes your API calls — it is attached automatically to requests. Because it expires quickly, the refresh token is used behind the scenes to mint a new access token without forcing you to log in again, up to its own 7-day window. In practice you stay signed in for a working week of activity; after that, or after signing out, you log in fresh.

Admins who sign in are routed to the /admin console; learners land in the learner shell (/learn, dashboard, progress).

Step 4 — Recover a forgotten password

On the Login screen, choose Forgot password.
Enter your account email. The platform sends a reset link (again via SMTP in production, or the logs in dev).
Open the link and set a new password on the reset screen.
Log in with the new password.

The reset link works the same way as verification: a scoped, time-limited token that authorizes exactly one password change. Once you set the new password, old sessions should be re-authenticated.

When it goes wrong

Symptom	Likely cause	What to do
No verification email arrives	SMTP not configured, or dev environment	Check the backend logs for the link; in prod, confirm SMTP settings
"Please verify your email" on login	Account created but link never clicked	Re-open the verification link, or request a new one
Logged out unexpectedly after a while	Access token expired and refresh window elapsed (7 days)	Log in again
Reset link says invalid/expired	Token already used or too old	Request a fresh reset from Forgot password
Registration succeeds but admin console is missing	You registered as a normal learner	Admins are env-seeded, not registered — set `ADMIN_EMAIL`/`ADMIN_PASSWORD`

Warning: Never share a verification or reset link. Each one is a bearer token that lets whoever holds it confirm the account or change its password. Treat them like a temporary password.

What you get

Once you're verified and signed in, your identity is the anchor for everything the platform tracks: LessonProgress and completion stats, ExerciseAttempt history, personal notes and bookmarks, likes and discussions, your follow graph and public profile, and earned achievements. Your access token rides along on every request so those features know who you are, and the refresh token keeps you signed in through a normal week of study without repeated logins.

Head to /learn and open a published lesson to start reading, then jump into /practice/[lessonId] to try the exercises — your attempts now count toward your progress.
Fill in your profile and upload an avatar so your public profile and activity feed represent you.
If you're an admin, confirm your seeded account lands you in /admin, then start building a syllabus and generating lessons.