Sign-in and OTP code problems

What it means#

Two kinds of problems: a new sign-up whose 5-digit OTP verification code does not arrive or is rejected, and a sign-in that fails, usually with a message naming the reason.

Who is affected#

• A merchant registering on a delivery company's site: the code arrives by SMS.
• A new company owner registering from the company sign-up page on the main domain: the code arrives by email.
• An independent merchant registering from the independent merchant sign-up (Join) page has no OTP step: the account is created already activated and goes straight to the plans page (limited to five sign-ups per IP address per day).
• Every user when signing in, including company staff and couriers.

Likely causes#

The OTP code

• The code is exactly 5 digits, valid for 10 minutes, allows 5 wrong attempts and works once. After it expires or the attempts are used up, even the correct code is refused; request a new one.
• For a 5-digit code the web page shows "Invalid OTP" in every case (wrong, expired, attempts used up or lost session); the page itself is in English. Any other length shows the standard field error under the OTP box. The mobile API returns the localized message («OTP غير صحيح» in Arabic) with HTTP 401.
• The verification page takes the mobile number (or the email, for companies) from the session; in another browser or after the session ended, the code is rejected.
• The code does not arrive: SMS goes out only through the REVE or Twilio provider, and only if one is switched on in the SMS settings; if neither is, nothing is sent, yet the page still says the code was sent. A company's code goes by email and needs working mail settings: if sending fails during sign-up, the sign-up itself fails with "Something went wrong." (shown in English) instead of reaching the OTP page; only "Resend Code!" can report success while sending fails.
• "Resend Code!" issues a new code that cancels the previous one and resets the attempt counter. It works only for an account that is not yet activated. The web route has no resend limit; the mobile API (/api/v10) allows 3 resend requests and 10 verification requests per minute.

Signing in

• Account details (suspended, not activated, belongs to another company) show only when the password is correct; otherwise you get the first message.
• The sign-in field accepts an email or a mobile number. On the main domain, a correct password sends you to your company's domain with a one-time link valid for 2 minutes.
• Temporary lockout: on your own company's domain, 5 failed attempts with the same email or mobile from the same IP address block sign-in for about a minute (HTTP 429). A wrong password for a known account typed on the main domain or on another company's domain is rejected without counting.
• "Forgot password?" sends a link by email. A merchant who registered through the company site's form has no email on file, so it cannot reach them.
• A courier signing in through the mobile API sees «رقم الدخول (أو الموبايل) أو كلمة المرور غلط.‏» (HTTP 401) for a wrong number or password, or «حساب المندوب موقوف — تواصل مع شركتك.‏» (courier suspended; HTTP 403). A missing field or a password shorter than 6 characters gets HTTP 422 with the message "Credentials not match" (in Arabic «أوراق الاعتماد غير متطابقة»), and a missing or wrong apiKey header gets HTTP 400 with "Invalid Api Key". The limit is 10 attempts per minute.

How to diagnose#

• Match the message to the table above, and do not retry before you know the cause, so you keep your attempts.
• On the OTP page check the masked number; if it shows only asterisks with no digits (and the Merchant ID is blank), the session was lost.

Resolution steps#

1. Request a new code

   Press "Resend Code!" and enter the latest code within 10 minutes and 5 attempts.

2. Stay in the same browser

   Finish verification in the browser you registered from and do not close the page. If the session is lost, contact support.

3. Check where the code should arrive

   A merchant gets an SMS on the mobile typed at registration; a company owner gets an email at the address typed. If nothing arrives after resending, the sending setup is the problem and support handles it.

4. Sign in on the right domain

   Sign in on your own company's domain (the one named in the "belongs to another company" message). If you are temporarily locked, wait a minute and try again.

5. Fix the account state and the password

   If the account is suspended or not activated, contact your company's admin. If you forgot the password, use "Forgot password?", or ask a staff member who can edit merchants to set a new one from the merchant's edit page.

When to contact support#

• The code does not arrive despite resending, the session was lost before verification finished, or a company sign-up fails with "Something went wrong.".
• You see "The account is not activated yet" after verifying, or "Could not sign in to this account on this domain." with a correct password.
• Send the registered mobile or email (never the password), the time of the attempt, the full message text and your company's domain name.