Accounts & Authentication

Creating a Business Account

There are two paths to create a business account on WineView:

Go to the WineView homepage and click Sign Up
On the signup form, enter your Name, Email, and Password
Click Create Account
Verify your email address via the confirmation email that arrives in your inbox
After verifying, log in at /auth/login
You are redirected to /dashboard/business/onboarding — the onboarding checklist
Complete the onboarding steps: set up your first club, connect your Stripe account for payments, and configure your first location

Go directly to the business registration page at /dashboard/business/register
Step 1 — Business Info: Enter your Business Name, Business Type (dropdown: winery, wine bar, brewery, etc.), and Website (optional)
Step 2 — Contact Info: Enter your Name, Email, Phone, and Password
Click Create Business
Verify your email address via the confirmation email
After verifying, log in at /auth/login
You are redirected to /dashboard/business/onboarding to complete setup

Creating a Member Account

There are two ways to create a member account:

During Checkout

Browse a winery's club listing page and click Join on the tier you want
On the checkout page, enter your Name, Email, Password, Phone, and Birthday
Enter your Shipping Address (must be in one of the winery's allowed shipping states) or select Local Pickup and choose a pickup location
Enter your Payment Method (credit/debit card via Stripe)
Click Join Club to complete your purchase
Your account is created automatically and you receive a welcome email with login credentials

Go to /auth/login and click Create an account
Enter your Name, Email, and Password
Click Sign Up
Verify your email via the confirmation link
Log in and browse clubs to join

Logging In

WineView supports two ways to log in:

Email and Password

Go to /auth/login
Enter your Email and Password
Click Log In
You are directed to the appropriate dashboard based on your role:
- Business owners/staff → Business dashboard (/dashboard)
- Club members → Member dashboard

Magic Link (Passwordless)

For consumers signing into a business's Rewards Program, WineView supports passwordless email links:

Go to a business's rewards login page at /business/[id]/rewards/login (or rewards signup at /business/[id]/rewards/join)
Enter your Email and click Send me a link
Check your inbox for an email titled "Sign in to your account"
Click the link in the email — you're signed in automatically and routed to your member rewards page

Magic-link rules:

Links expire after 30 minutes
Each link is single-use — clicking it twice will fail with "This link has already been used"
A maximum of 3 links can be requested per email per 15-minute window; over-limit requests are silently dropped
If the email isn't tied to an existing account, signing in with a magic link creates the account on the spot using the name/phone/birthday you provided at signup

Magic links are currently used for the public Rewards Program signup and login flows. Email + password remains the primary login path for everything else.

All authentication is email-based. There is no social login (Google, Apple, etc.).

Multi-Role Accounts

The same email address can have both business and member roles. When you log in, you're directed to the appropriate context automatically. Business users can switch to their member view and vice versa via the UserMenu in the top-right corner of the dashboard.

Password Management

Changing Your Password

You can change your password from your account settings page:

Click your avatar or name in the top-right corner of the dashboard to open the UserMenu
Navigate to your Account Settings
Enter your Current Password and your New Password
Click Save

Temporary Passwords (Staff Accounts)

When a business owner adds a team member, that team member receives a temporary password. On their first login, WineView displays the PasswordChangeWrapper — a full-screen prompt that requires them to set a new permanent password before they can access any other page. They cannot dismiss or skip this prompt.

Forgot Password

Go to /auth/login
Click Forgot Password? below the login form
Enter your Email address
Click Send Reset Link
Check your inbox for a password reset email (the link expires in 15 minutes)
Click the link in the email — you're taken to a page to set a new password
Enter your New Password and click Reset Password

If you don't receive the email, check your spam folder. Reset links can only be used once.

Your Profile

Both business owners and members can manage:

Name — Displayed across the platform
Email — Used for login and notifications
Phone number — Used for contact and loyalty lookups at POS
Birthday — Used for age verification where required

Addresses

You can save multiple addresses with labels (e.g., "Home", "Office"). One address can be marked as default for shipping. Addresses include street, apartment/unit, city, state, zip code, and country.

Business owners can also add and manage addresses on behalf of their members when needed (e.g., during CRM import or when helping a member update their info).

Age Verification

For compliance, some flows may require identity verification. The verification status can be:

Pending — Verification submitted, awaiting review
Approved — Identity confirmed
Declined — Verification failed

User Roles

Business owner — Full access to the business dashboard and management features. Can add/remove team members, manage all settings, and deactivate accounts.
Team member — Access determined by role-based permissions (RBAC) set by the business owner. Custom roles can be created with specific permission toggles.
Member — Access to the member dashboard for managing memberships, orders, and rewards.

Account Security

Passwords are securely hashed
Sessions are maintained via authentication tokens
Staff members set up with temporary passwords are prompted to change them on first login via the PasswordChangeWrapper
Password reset links expire after 15 minutes and can only be used once
Magic-link tokens are stored hashed (never in plaintext), expire after 30 minutes, are single-use, and rate-limited to 3 requests per email per 15 minutes