Login and Account Security
The Admin App shares the same accounts as the Web admin panel: change a password, bind an email, or toggle two-factor authentication on one side, and it takes effect on the other immediately. This page covers the login flow and personal settings on the phone.
Login
- Enter the account and password (the password is transmitted encrypted); the first login requires accepting the user agreement and privacy policy (the acceptance is remembered — no need to check it again next time);
- After consecutive failures reach the threshold, a CAPTCHA appears and must be solved to keep trying — a defense against credential stuffing;
- For accounts with two-factor authentication enabled, after the password passes, enter a TOTP one-time code or a recovery code to complete the second step;
- The top-right of the login page toggles the light / dark appearance; the brand info follows the site's system name config.
Forced password change: when the account is still on its initial password or the password has expired, you are taken straight to the change-password page after login; the system opens only after the change.
Forgot password: from the login page, recovery is a two-step flow — (1) enter the account, the bound email, and the CAPTCHA; the system emails a verification code; (2) enter the email code and a new password to finish the reset. This requires the account to have a bound email and the email service to be configured; otherwise it cannot be submitted.
The "Me" Page
Account and Security
| Setting | Description |
|---|---|
| Profile | Avatar, nickname, and other basics |
| Change Password | Verify the old password, then set a new one that meets the password policy |
| Email Management | Bind, rebind, and unbind an email — self-service password recovery depends on it |
| Third-Party Account Binding | Bindings for third-party logins such as WeChat |
| Two-Factor Authentication | Enable / disable TOTP; regenerate and view recovery codes |
General Settings
- Language: ten languages in the app and H5 builds; Chinese and English only in the mini-program builds;
- Dark Mode: follow the system or set manually.
About
User agreement, privacy policy, help, and version info.
Multi-Device Sessions
- After the password is reset (including by an administrator in the back office), the app and the Web panel go offline simultaneously and require a re-login;
- The two-factor authentication toggle and recovery codes sync across devices.
Related Links
- User Management: account security mechanics from the Web perspective
- Notifications and System: the entry point for login log investigation
- Admin App Feature Map