User Registration & Authentication
CoinTrail provides a complete authentication system including registration, login, password recovery, email verification, and social login. This section covers all user-facing authentication features.
On This Page
Registration Process
Users can create an account through the standard registration form:
Registration Form Fields
| Field | Type | Validation | Description |
|---|---|---|---|
| Name | Text | Required, max 255 | User's display name |
| Required, unique, valid email | Used for login and notifications | ||
| Password | Password | Required, min 8 chars | Must include mixed case and numbers (configurable) |
| Confirm Password | Password | Must match password | Password confirmation |
| Terms Agreement | Checkbox | Required | Accept Terms of Service and Privacy Policy |
| Newsletter | Checkbox | Optional | Subscribe to newsletter (opt-in) |
| reCAPTCHA | CAPTCHA | If enabled | Spam protection |
Registration Flow
The registration form with all required fields and validation
User Fills Form
User provides name, email, and creates a password. They must agree to the Terms of Service.
Validation
Server validates all fields. Email uniqueness is checked, password strength is verified.
Account Created
User record is created with Free tier subscription and unverified email status.
Verification Email
If email verification is enabled, a verification email is sent with a unique link.
Welcome Email
A welcome email is sent with account information and getting started tips.
New users are automatically assigned the Free tier subscription. They can upgrade to Premium or Pro from their account settings.
Email Verification
Email verification ensures users provide a valid email address:
Verification Process
- After registration, user receives an email with a verification link
- The link contains a unique, time-limited token
- User clicks the link to verify their email
- Account is marked as verified and full access is granted
Verification Settings
| Setting | Location | Description |
|---|---|---|
email_verification_required |
Admin Settings | Require verification before login |
verification_token_expiry |
config/auth.php | Token expiration time (default: 60 minutes) |
Resend Verification
Users can request a new verification email if:
- The original email was not received
- The verification link has expired
- The user changed their email address
Login Process
Registered users can log in using their credentials:
The login form with authentication options
Login Form Fields
| Field | Type | Description |
|---|---|---|
| Registered email address | ||
| Password | Password | Account password |
| Remember Me | Checkbox | Keep user logged in (extends session) |
| reCAPTCHA | CAPTCHA | Shown after failed attempts (if enabled) |
Login Security Features
Rate Limiting
After 5 failed attempts, account is temporarily locked for 15 minutes.
Two-Factor Auth
If 2FA is enabled, user must enter TOTP code after password.
Login Notifications
Optional email notification for logins from new devices/locations.
Session Management
Users can view and revoke active sessions from security settings.
Social Login
Users can register and login using social media accounts:
Supported Providers
Social login options displayed on the login and registration pages
One-click login with Facebook. Retrieves name, email, and profile picture.
Twitter/X
Login with Twitter account. Retrieves username and profile data.
Sign in with Google. Retrieves name, email, and profile picture.
Social Login Flow
User Clicks Social Button
User clicks "Login with Facebook/Google/Twitter" button on login or register page.
OAuth Authorization
User is redirected to the social provider to authorize access.
Callback Processing
Provider redirects back with user data. System checks if account exists.
Account Handling
If new: Account is created with social data, email auto-verified.
If existing: Social account is linked and user is logged in.
If a user registers with social login and their email matches an existing account, they will be prompted to link accounts or use a different method. This prevents duplicate accounts.
Password Recovery
Users who forget their password can reset it via email:
Recovery Process
Request Reset
User enters their email on the "Forgot Password" page.
Email Sent
If email exists, a password reset link is sent. Link expires in 60 minutes.
Reset Password
User clicks link and enters a new password (with confirmation).
Confirmation
Password is updated, user receives confirmation email, and all other sessions are invalidated.
The system does not reveal whether an email exists in the database. Users always see the same message: "If your email is registered, you will receive a reset link."
Profile Management
Users can manage their profile from the account dashboard:
User Dashboard → Profile Settings (/user/profile)
Profile Fields
Profile management page where users can update their information
- Name - Display name shown on profile
- Username - Unique username for profile URL
- Avatar - Profile picture (upload or Gravatar)
- Bio - Short biography or description
- Website - Personal or company website
- Country - Country of residence
- Timezone - For accurate time display
- Preferred Currency - Display currency for prices (USD, EUR, etc.)
- Language - Interface language preference
- Twitter/X - Twitter handle
- Telegram - Telegram username
- Discord - Discord username
- LinkedIn - LinkedIn profile URL
Account Settings
User Dashboard → Settings (/user/settings)
Email Settings
| Setting | Description |
|---|---|
| Change Email | Update email address (requires verification) |
| Email Notifications | Toggle email notifications on/off |
| Price Alert Emails | Receive emails when price alerts trigger |
| Newsletter | Subscribe/unsubscribe from newsletter |
| Marketing Emails | Receive promotional content |
Password Settings
- Change Password - Requires current password
- Password Requirements - Minimum 8 characters, mixed case recommended
- Password Confirmation - Must enter new password twice
Account Actions
Export Data
Download all personal data (GDPR compliance). Premium+ feature.
Disconnect Social
Unlink social accounts from profile.
Logout All Devices
End all active sessions except current.
Delete Account
Permanently delete account and all data.
Account deletion is permanent and cannot be undone. All data including portfolio, watchlist, alerts, and payment history will be permanently removed. Active subscriptions are cancelled without refund.