Sign-in and security

Signing in#

Sign in with your email address and password, or with a passkey. ONE Travel OS limits how often you can try, and the password form has a bot check, so a few things besides a wrong password can stop you:

• “Set your password from your invitation email before signing in.” Your account exists but you haven’t accepted the invitation. Use the link in the invitation email (it lasts 7 days; an admin can resend a fresh one).
• “You can’t sign in to this account yet. Ask your agency admin to send you an invitation.” Your agency put you on the roster, usually while bringing an existing book of business across, and sent no invitation. A password reset will not help: ask an admin to send the invitation. Your households, bookings and commission are already in ONE Travel OS.
• “This account is no longer active. Contact your agency admin.” The account has been terminated.
• “Complete the security check and try again.” The bot check didn’t pass; retry it.

Your password#

Wherever you set one (accepting an invitation, resetting a forgotten password, or changing it), it must be at least 8 characters and include an uppercase letter, a lowercase letter, a number, and a symbol. A space counts as a symbol, so a short phrase like Two blue vans 4 qualifies and is easier to remember than a mangled word.

The strength meter

As you type a new password, on the invitation screen and under your name → Security, a bar rates how guessable it is and how long it would take to crack.

Passw0rd! meets every part of the rule above and is among the first few thousand strings any attacker tries, so the meter calls it Weak. It scores how quickly a password-cracker would reach yours: common passwords, keyboard runs like qwerty and 1qaz2wsx, repeats, sequences, dates, and predictable substitutions like @ for a. It also knows your email address and name, so a password built from either scores badly.

Ratings run Very weak to Very strong, with a line underneath saying what to fix. The quoted time assumes the worst realistic case, an attacker grinding a stolen copy of the whole password database offline, so a comfortable number can be trusted.

The rating advises; it does not block. You can save a password the bar dislikes if it meets the rule above. The breach check below is the one exception, and it does block.

Whether your password has already been leaked

Under the rating is a separate reading: whether the exact password you typed appears in a public data breach.

The two can disagree. A password with no dictionary word, keyboard run or date rates Very strong, yet is worthless if somebody else chose it first and it was published in a breach dump. Attackers try those lists before they guess anything.

You will see one of two lines:

• “This password has appeared in n known data breaches. It will not be accepted.” This is the one enforced reading on the page: saving is refused until you choose another. The number counts appearances across every breach on record. It says nothing about your account here, only that this exact string is on a list attackers already have.
• “Not found in any known data breach.” The weaker statement: this password is not in the published lists, which does not make it a good one. The rating still applies.

If neither line appears, the breach service was unreachable and the meter says nothing rather than guessing. The block is lifted too: a password is never refused on a check that did not happen, so an outage never stops you setting or resetting one.

If your password leaks later

The check above runs when you set a password. A password can be fine then and turn up in a breach two years later, because somebody else used it on a site that was then broken into.

ONE Travel OS checks again when you sign in, at most once a month. If the answer has changed, a banner appears at the top of every page:

Your password has appeared in a data breach. It was not in one when you chose it, so it has been published since.

It never locks you out, since you would then have nowhere to fix it. It cannot be dismissed and stays until you change your password. Change it here and anywhere else you used it: attackers try a leaked email-and-password pair on every site.

Your password is not sent anywhere. Your browser works out the rating on its own. For the breach check, your browser scrambles the password into a fingerprint, sends only its first five characters to ONE Travel OS, and gets back every leaked fingerprint starting with those five, several hundred of them, to compare locally. Roughly eight hundred different passwords share those five characters, so they identify no one password. Your browser never contacts the breach service; ONE Travel OS asks on your behalf.

Changing it

Your name → Security → Password. Type your current password, then the new one twice, and choose Change password.

Changing it signs out every other browser signed in as you. The one you changed it in stays signed in.

If the current password is wrong, or the new one breaks the rule above, the page comes back with a message and nothing changes.

Password managers work on this page: yours can fill your current password and save the new one, and a Change password button on its ONE Travel OS entry lands here.

Nobody sets your password but you. An admin can’t change it from the roster, and the whole Security page is closed while anyone is viewing ONE Travel OS as you, so nobody can use a support session to take an account over. If you are locked out, use the reset link, which goes to your mailbox.

Changing your sign-in address#

Your email address is what you sign in with, where password resets go, and the name every screen gives you. Change it under Account → Your details, in the Your sign-in address box: enter the new address and your current password, then Send confirmation link.

A link goes to the new address, and your sign-in address moves only when you follow it. That proves you can read mail there, and so receive a password reset.

• The link opens Confirm your new sign-in address, and asks you to sign in first if you are not already, with your current address, which works until you press Make it my sign-in address. Opening the page changes nothing; the press does.
• It lasts 1 day. Send the form again for a fresh one; the earlier link stops working.
• While a change is waiting, the box says so and offers Cancel. Entering a different address replaces the waiting one and cancels its link.
• The password is asked every time and a wrong one is refused, so somebody using your session, including an admin viewing ONE Travel OS as you, cannot move your address.
• An address that already has an account, at any agency, is refused, and so is the one you already have. So is anything that is not an email address: “New sign-in address must look like [email protected].”
• Once confirmed, your old address is emailed that the change happened and what signs in now. Your password, two-factor enrollment and open sessions are untouched.
• Mail is matched by your sign-in address, so the switch is a hard cutover. Mail already filed against you stays put. From the moment the address changes, mail from the old address (a forward to your intake address, a supplier copying you) is no longer recognized as yours, and mail from the new one is. Give suppliers the new address, and forward from it.

An admin can also change it for you from the roster, without the confirmation step; both addresses are emailed. See Advisors. An admin’s own address is the exception: it changes only here, on Your details.

Passkeys#

A passkey lets you sign in with your fingerprint, face or device PIN instead of a password and code. Your device or password manager keeps it. It works only on ONE Travel OS, so a fake sign-in page has nothing to collect.

Signing in with one

On the sign-in page, either:

• click into Email address, where your browser lists the passkeys it holds for ONE Travel OS among its suggestions, and pick one; or
• choose Sign in with a passkey under the form.

Your device asks for your fingerprint, face or PIN, and you’re in. You type no password and no two-factor code, because the passkey and the unlock together count as both. The button appears only in browsers that support passkeys.

If the page refuses a passkey, it says “We couldn’t sign you in with that passkey. Use your email address and password.” You’ll see that for a passkey you removed from the Security page, or one saved for a different account. Your password and two-factor code keep working.

Adding one

Your name → Security → Passkeys. Under Add a passkey, give it a Name (the device it’s on, such as “Work laptop”), type your Current password, and choose Add a passkey. Your browser or device then asks you to confirm with your fingerprint, face or PIN. When it’s done, the page names the passkey you added and says you can sign in with it next time.

• Add one on each device you sign in from. A laptop and a phone are two passkeys, and the list shows each one.
• ONE Travel OS asks for your current password every time, so somebody using a browser you left signed in can’t add a passkey of their own.
• If you cancel the device prompt, nothing changes. Choose Add a passkey again when you’re ready.
• If the page says “This browser cannot create passkeys.”, open it in a current version of Safari, Chrome, Edge or Firefox.

Renaming or removing one

The list shows when you added each passkey. Rename changes its name. Remove stops it signing you in. It doesn’t ask for your password, so you can remove the passkey on a lost device from any other browser.

The email you get

ONE Travel OS emails your sign-in address whenever you add or remove a passkey. The email names the passkey, says when and from which browser, and links to your Security page. If you didn’t make the change, remove the passkey there, change your password, and use Sign out everywhere.

A passkey doesn’t replace your password or your two-factor code, and both keep working. Where your agency requires two-factor authentication for admins, a passkey doesn’t count toward it. Nobody viewing ONE Travel OS as you can add or remove your passkeys, or change anything else on the Security page.

Signing out everywhere#

Your name → Security → Signed-in browsers → Sign out everywhere ends every session signed in as you, including the one you are using, so you sign in again right afterwards. Use it for a session left open on a machine you no longer have, or one you think somebody else is using.

Plain Sign out, at the foot of the Account menu, ends only the browser you’re in.

Your forwarding address#

If your agency has intake addresses set up, you have one of your own at the foot of Your details, under Your forwarding address. Forward a confirmation to it and it is read into a draft booking and itinerary. Copy beside it puts it on your clipboard.

It sits below Your booking addresses, and the two are opposites, as the card says (“This one is ours, not yours”). The addresses above are yours, the ones suppliers write to, listed so their mail is sorted properly. This one is ours, and you forward to it.

• What you send arrives unfiled. Your address says who you are, not which trip, so a confirmation forwarded here waits for you. To have one file itself, use that trip’s own address.
• Only mail from your own sign-in address is read straight away. Anything else is recorded and waits for you, and nothing it carried is kept.

Rotate this address issues a new one and stops the old one reaching you, including anywhere you already gave it out. Nothing else changes.

Accepting your invitation#

The invitation link opens Set up your account. It asks for a password, held to the same rule as any other, and the details your contractor agreement and 1099 are made out to:

It is one save: if the form comes back with an error, your password is not set either and the invitation link still works. Only your agency’s admins can see these details.

Federal tax classification is line 3a of a W-9; your agency needs it to know what to report. Pick from:

• Individual / sole proprietor or single-member LLC
• C corporation, S corporation, Partnership, Trust / estate
• LLC taxed as a C corporation, an S corporation, or a partnership

A single-member LLC that has not elected corporate treatment is taxed as its owner, so choose the first option, as a W-9 does. If you file as something outside this list, tell your agency rather than guessing; they will need to collect your W-9 on paper.

Change any of them later under Account → Your details. If they are ever missing (on an account made before this screen existed, say), the app holds you on that page until you fill them in, because neither an agreement nor your W-9 can be drawn without them.

Your agency can generate your W-9 from these details and send it for you to sign: the same substitute Form W-9 with your details filled in. You sign the certification and it is filed for you. You sign under penalties of perjury, so first read what it says about your TIN, backup withholding and US-person status. If anything on it is wrong, correct it under Account → Your details and ask your agency to send a fresh one instead of signing.

Your agency may email you for your W-9 details. The email links to Your W-9 details, and you sign in first. Check your legal name, address and Federal tax classification, and enter your Taxpayer identification number (SSN or EIN): 9 digits, with or without dashes. The box never shows a number you saved before. It says A number is on file instead, and leaving it blank keeps that number. Press Save and send my W-9 to sign, and your W-9 arrives by email for you to sign. If your agency pays through Mercury, Mercury then emails you a link to add the bank account your payouts go to. If the button reads Save W-9 details, your agency sends you the W-9 itself. Once your W-9 is out for signature or on file, the page shows where it stands instead of the form.

Your accreditation numbers sit at the foot of that page and are optional: IATA/IATAN, CLIA, ARC and TIDS. Fill one in only if you hold it and book under it; supplier pages then show yours instead of the agency’s. Leave them blank, as most advisors do, and supplier pages show the agency’s number. The full rule is under what the agency books under.

On the invitation screen the address boxes are plain text, because the address lookup needs you signed in. Under Account → Your details the same Mailing address box offers suggestions: type three characters, pick one, and City, State and ZIP fill in. Apartment, suite is left for you, because the lookup returns the building and not the unit. Every box stays editable.

Forgotten password#

Use the reset link on the sign-in page. For your security the confirmation reads the same whether or not the address exists. The reset link is good for 15 minutes, and the new password is held to the same rule as any other. Setting it ends every other session.

If you know your current password and want a different one, change it from your name → Security without signing out or waiting for mail.

Agreeing to the terms#

The first time you sign in, and again when the Terms of Service change, ONE Travel OS asks you to agree before you go any further. Tick the box and choose Agree and continue. See Legal documents.

Analytics cookies#

The first time you sign in, a note in the bottom corner says We use cookies to see how you use ONE Travel OS. It asks about PostHog, which shows us the pages and buttons you use.

• Yes: PostHog sets a cookie, sees your clicks and records your sessions with every word on screen hidden.
• Essential only: no analytics cookie. PostHog counts the pages you open without knowing it was you.

You can keep working while the note is open. Until you answer, PostHog gets nothing from your browser.

Your answer stays with your account, in any browser. To change it, open Account → Your details and use the Analytics cookies box. Households don’t see the note: the client portal and the public site run no analytics. The privacy policy has the details.

The two-factor step#

If two-factor authentication is on for your account, you also need the six-digit code from your authenticator app. The code tolerates a little clock drift, each code works only once, and too many wrong attempts send you back to the start.

Lost your phone? Type one of your recovery codes in the code field instead; each signs you in once. If those are gone too, an agency admin can reset your enrollment from your advisor page; you’ll be signed out everywhere and asked to set up a new device. Codes and secrets are stored as one-way digests, so nobody, support included, can read one back to you.

Full details on enrolling, recovery codes, and agency two-factor policy are in Two-factor authentication (sign-in required).

Households of an agency#

If you’re a household and were sent an access code, you don’t sign in here: the client portal is your door.