Signing in, security and roles

Bookasport has two entrances, each with its own address.

Who	Address	For
The studio's staff	https://studio.bookasport.nl	The back office: schedule, members, products, payments, settings.
The studio's members	https://<studio>.bookasport.nl	The member site: viewing the schedule, booking, buying, managing a membership.

The studio name in the member address is the short name Bookasport set when your studio was set up (for example pillar.bookasport.nl). If you open the back office login on the member address by mistake, you are redirected to studio.bookasport.nl automatically.

1. Go to https://studio.bookasport.nl. You land on the screen Inloggen voor medewerkers (sign in for staff).
2. Fill in your E-mailadres (e-mail address) and Wachtwoord (password) and click Inloggen (sign in).
3. You land on the Rooster (schedule) of your studio. If you are the owner, Bookasport first asks for the code from your authenticator app (see below).

If signing in fails you always see the same message: Inloggen mislukt. Controleer je e-mailadres en wachtwoord. (sign-in failed, check your e-mail address and password). Bookasport deliberately does not say whether the address is known or only the password was wrong.

Too many attempts. After ten failed attempts on the same e-mail address within a quarter of an hour, Bookasport blocks signing in on that address for a quarter of an hour, even with the right password. You then see Te veel mislukte pogingen. Probeer het over een kwartier opnieuw, of stel een nieuw wachtwoord in. (too many failed attempts; try again in fifteen minutes, or set a new password). The quickest way out is Wachtwoord vergeten? (forgot your password?): after setting a new password you are signed in immediately.

Staying signed in. A session stays valid for thirty days as long as you use the back office now and then. On a shared computer at the front desk, sign out afterwards with Uitloggen (sign out), at the bottom of the sidebar on a laptop and at the bottom of the Meer (more) screen on a phone.

Staff accounts are created by Bookasport. There is no screen to add colleagues yourself, change a role or remove someone. To give a manager, front desk employee or instructor access, or to take access away, contact Bookasport. A new staff member picks their first password themselves through Wachtwoord vergeten? on the login screen.

The owner manages money and member data. That is why Bookasport asks the owner for a six-digit code from an authenticator app at every sign-in, in addition to the password. This applies to the owner role only. A manager, the front desk and instructors sign in with their password alone. Members notice nothing of it.

Suitable apps are Google Authenticator, Microsoft Authenticator or 1Password, for example. Any app that generates time-based codes works. There are no SMS codes and no codes by e-mail.

Setting up the authenticator (first time)

If the owner signs in without an authenticator yet, they land directly on the screen Beveilig je account (secure your account). Without this step the back office cannot be opened, not even through a direct link.

1. Open your authenticator app and scan the QR code on the screen. If you cannot scan, click Kun je niet scannen? Voer het geheim handmatig in. (can't scan? enter the secret by hand) and copy the secret into your app with Kopieer (copy).
2. Enter the code the app shows in the field Code uit je app (code from your app) and click Instellen (set up).
3. You land on the schedule. From now on Bookasport asks for the current code at every sign-in.

Good to know:

• Every time you reload the Beveilig je account screen, Bookasport generates a new QR code and the previous one expires. If you had already scanned the previous one, remove that entry from your app and scan again. The screen says so too: Heb je deze pagina al eerder geopend? Verwijder dat Bookasport-item uit je authenticator-app; alleen deze QR-code werkt. (opened this page before? remove that Bookasport entry from your app; only this QR code works).
• A wrong code leaves the same QR code in place. Simply try again with the next code.
• The entry is called Authenticator (or Bookasport, depending on the app).

Signing in with the code

After the password, the owner lands on the screen Voer je code in (enter your code). Enter the six-digit code from your app and click Doorgaan (continue). Spaces in the code are fine.

Messages you may see:

Message	What it means
Voer de zes cijfers uit je authenticator-app in.	The code does not have the right form (six digits).
Code onjuist of verlopen. Probeer de volgende code uit je app.	The code is wrong or has just expired. Wait for the next code. If it keeps failing, check that your phone's clock is set to automatic.
Te veel mislukte pogingen. Probeer het over een kwartier opnieuw.	After nine wrong codes within a quarter of an hour, Bookasport blocks entry for a quarter of an hour.
Er ging iets mis. Probeer het opnieuw.	A temporary fault.

There are no recovery codes and no "trust this device" option. The code is asked at every sign-in. After that the session stays valid for thirty days as usual, so in practice you rarely enter the code.

Phone lost or replaced

You cannot switch off, replace or duplicate the authenticator yourself. If you have lost your phone or have a new one, this is the procedure:

1. E-mail support@bookasport.nl from the e-mail address of your own account. A request from another address, or by phone only, is not handled.
2. Bookasport replies to that address and calls back on the studio's known number to verify the request.
3. After verification Bookasport removes the authenticator and the running sessions, and makes the old password unusable.
4. You pick a new password through Wachtwoord vergeten?. After saving you are signed in and land on Beveilig je account to set up a new authenticator.

The same instruction is in the back office under Meer, in the block Beveiliging (security). There you also see since when your authenticator has been set up.

If the owner is also a member

One e-mail address is one account, for the whole studio. If the owner is also a member of her own studio, she logs in to the member site with the same password. Two things are then different:

• Every time she enters her code in the back office, her member sessions are logged out. Logging in again on the member site is enough.
• She can change or reset her password only through the back office. If she tries it on the member site, she sees: Your account uses an authenticator app. Change or reset your password in the back office where you log in as the owner; it will ask for your code.

1. On the login screen click Wachtwoord vergeten? and enter your e-mail address. Click Stuur me een link (send me a link).
2. You always see the same confirmation, even if the address is unknown: Als we dit adres kennen, sturen we je een e-mail. (if we know this address, we will send you an e-mail).
3. Open the e-mail Nieuw wachtwoord voor <studio> (new password for <studio>) and click Nieuw wachtwoord instellen (set a new password). The link is valid for one hour and works once.
4. Enter a new password (at least 8 characters, no other requirements) and repeat it. Click Opslaan (save). If you have an authenticator, this screen also asks for your code.
5. You are signed in immediately. All other sessions of your account, on other devices too, are ended. An owner enters the code from the app once more.

Good to know:

• Bookasport sends at most one reset e-mail per address per ten minutes. If you request again within that time, no second e-mail is sent and the first link stays valid.
• An expired or already used link brings you back to the form with the message Deze link is verlopen. Vraag een nieuwe aan. (this link has expired, request a new one).
• If the e-mail does not arrive, check your spam folder. The sender is Bookasport, address noreply@bookasport.nl.
• This form is for staff. A member uses the form on the member site of their studio.

Go to Meer and use the block Wachtwoord wijzigen (change password). Enter your Huidig wachtwoord (current password), then the new one twice, and click Wijzigen (change). After Je wachtwoord is gewijzigd. (your password has been changed) your other sessions are logged out; the session you are working in stays open.

You cannot change your own e-mail address. Contact Bookasport for that.

Every staff member has one role at the studio. Which role you have is not shown anywhere on screen; you notice it from the buttons you do or do not see. A button you do not see is not a security hole either: the database refuses the action regardless.

Role	What this role can do
Owner	Everything. As the only one: connect Mollie. As the only one required to: use the authenticator app.
Manager	The same as the owner, except connecting Mollie. No authenticator needed.
Front desk	All daily tasks with members: adding members, issuing class passes, suspending and reactivating passes, reviewing trial classes, booking someone in, marking attendance, removing someone from the waitlist. Sees payments and memberships, but cannot change anything there.
Instructor	Looks on: schedule, templates, members, trial classes, products. Can only mark attendance on the attendance list, and only if the studio allows it (see Aanwezigheid in Settings). Sees no payments and no memberships.

What only the owner and a manager can do:

• Plan and cancel classes, create, deactivate and roll out templates.
• Add, activate and deactivate products.
• Pause memberships, change their price, cancel them or settle them outside Mollie.
• Change the settings: who may mark attendance, the notification address and the reply address.

If a role opens a screen that is not for them, it says for example Je hebt geen rol om de betalingen te zien. (you have no role to see the payments). That is not a fault.

One staff member, one studio. If you work for two studios that both use Bookasport, you need two e-mail addresses for that. There is no studio switcher yet.

On a laptop there is a fixed sidebar on the left with the name of your studio and three groups:

• Plannen (planning): Rooster (schedule), Sjablonen (templates), Aanwezigheid (attendance), Embed.
• Mensen (people): Leden (members), Proeflessen (trial classes).
• Geld (money): Producten (products), Betalingen (payments), Abonnementen (memberships), Mollie-koppeling (Mollie connection).

Betalingen and Abonnementen are not shown to instructors. Mollie-koppeling is shown to the owner and a manager only. At the bottom is Uitloggen.

On a phone there is a bar at the bottom with four tabs: Rooster, Leden, Verkoop (sales) and Meer (more). Under Meer you find the rest: Sjablonen, Lesvormen, Aanwezigheid, Embed, Proeflessen, Betalingen, Abonnementen, Mollie-koppeling, the Beveiliging block, Wachtwoord wijzigen and Uitloggen. On a detail screen (a class or a member) there is no bar but a link back, such as Terug naar het rooster (back to the schedule).

The attendance list of a class is designed for a phone in an instructor's hand. The other screens are designed for a laptop, but work on a phone too.

Even geduld (please wait). If instead of the back office you see the screen Even geduld with the text Deze studio wordt bijgewerkt. Probeer het over een paar minuten opnieuw. (this studio is being updated, try again in a few minutes), Bookasport is rolling out a new version at that moment. It takes a few minutes. If you submit a form at exactly that moment, it may say De studio wordt bijgewerkt. Probeer het over een minuut opnieuw. Your data is not lost; try again a little later.

Er is iets misgegaan (something went wrong). On an unexpected error Bookasport shows this screen with a Foutcode (error code). Click Opnieuw proberen (try again). If it keeps failing, pass the error code on to Bookasport; it lets them find the cause.