Guide 07 · Developer docs

Members, accounts and gated content

Building a member area on Core dna: who a member is in the data, the sign-in flows and their templates, single sign-on and passkeys, the my-account routing convention, members-only content, sessions and the page cache, and the security checks to run before launch.

L2

Unit 02 of 07 9 pages

Registration, sign-in and password recovery

Updated 23/10/2026 01:43

Every account flow a member uses, each as its route, its template and what that template receives: registration, email confirmation, sign-in and sign-out, forgotten and changed passwords, one-click sign-in links and remember-me. For the theme developer building or restyling the account screens.

A theme developer's first member task is nearly always restyling these screens, and the framework ships a template for only one of them. Each flow is a route that renders a template at a fixed path, so the work is knowing the paths, what each template receives and how each form posts.

Start with Account routes and their templates, the map of every route and the conventions the forms share. Then the flows in the order a member meets them: Registering a member, Email confirmation (what the platform does and does not do, and how to avoid dead ends), Signing in and out, Forgotten and reset passwords and Changing a password. One-click sign-in links covers the tokens behind the reset email and campaign links, Remember me what keeping a member signed in actually does, and Restyling the account screens brings the templates together as a set. Sign-in through Google, Microsoft, Facebook and passkeys is in the next unit.

In this unit

Read in order

01 Account routes and their templates Every sign-in, registration and password route, with its URL, who may use it, the template it renders, what that template receives, and whether the framework ships one. The map to read before restyling any account screen, and the conventions every account form shares. 02 Registering a member Registration is off until switched on, and its settings decide the new account's type, status and groups. The settings, the form and its fields, adding a field, what happens on submit, and the case most sites handle badly: an email address that already has an account. 03 Email confirmation The states a member account can be in, what each allows, and how to confirm an address without leaving a new member at a dead end. 04 Signing in and out Password sign-in posts to /login, passes through the platform's authenticate step and lands the member where they were going. The form, its error states and what they must not reveal, where the member lands and how to keep the page they wanted, and what signing out does and does not end. 05 Forgotten and reset passwords A member who has forgotten their password asks for a link, the emailed link signs them in, and they choose a new password. Both halves, the link's lifetime and number of uses, the reset email and how to override it, and what a reset changes on the account. 06 Changing a password A signed-in member changes their password at /change-password by giving the current one. Why the current password is required, the form and its errors, the only password rule the platform has, and what happens to the member's other sessions. 07 One-click sign-in links A sign-in token is a link that signs one member in, a limited number of times, until it expires: the mechanism behind the password reset email, and available for campaign and re-engagement emails. How tokens are made, what the link does, when to use one, and the limits that keep it safe. 08 Remember me Remember-me lets a browser start a new session after the twelve-hour sign-in has run out, but only through a sign-in provider that can be refreshed. What is stored, how long it lives, the prompt members see, how it is revoked, and why a password-only site should leave it off. 09 Restyling the account screens The account screens are restyled by writing templates at the paths the routes render, as one set: the pages, the shared input partials, the messages and the emails. The full list of files, a field partial that handles its own errors, and what differs on a Twig site.