Devices and sign-in
How sign-in works with a Company ID and username, what to do when you forget either, how sign-in codes and trusted devices work, and how sessions end.
Signing in
- At your company’s own address (
<company>.bmexa.com) the page says Sign in to <Company> and asks only for a username and password. Anywhere else, enter your Company ID first: the first part of your company’s address, for examplesunrisefor sunrise.bmexa.com. You can paste the full address; BMexa reads the ID from it. - Enter your Username (an email still works for staff during the switch-over).
- Enter your Password and click Sign in. In the phone app, the Company ID and username are always required.
Forgotten username or password
- Forgot username? opens
/forgot-username: enter the Company ID and the Email or mobile number on your record and click Email my username. The username is emailed to the address on record; the page says the same thing whether or not a match was found. Staff, partner people and clients are all covered. - Forgot password? opens
/forgot-password: enter the Company ID and Username and click Send reset link. The link goes to the masked email shown, works once and lasts an hour. Choose a new password (at least 8 characters) signs you out everywhere else and forgets every trusted device. - An admin can also give you a one-time temporary password from Team › Users; you choose your own at the next sign-in.
Sign-in codes and trusted devices
A sign-in code is a second step after the password: a 6-digit code sent on WhatsApp from BMexa’s number to the verified mobile on your profile, or by email when no mobile is verified or the WhatsApp send fails. It is asked for on a device that is not trusted. Codes last 10 minutes, five wrong tries end a code, at most five codes are sent an hour, and Send again waits 30 seconds. On the code screen, Trust this device for 30 days is ticked by default; a new device, 30 days passing, a password change or reset, or Sign out everywhere all make a device untrusted again. Codes apply to staff sign-in only, not to the partner or client portals.
- For yourself: on your profile, the Sign-in codes card shows On or Off. Turn on sends a code to your mobile to verify it (Code from WhatsApp, Confirm); after that the card says where codes go and offers Turn off or Verify mobile.
- For the whole company: an admin opens Company settings › Security and switches on Require sign-in codes for everyone. Each person’s card then says “Your company requires sign-in codes” and has no Turn off.
Sessions and devices
- A web session lasts 24 hours and is not extended by activity; the phone app stays signed in for 30 days. Each session records the browser or device, its IP address and the time.
- Sign Out is in the avatar menu on the web. On a phone, the Me sheet also lists your Signed-in devices (“Chrome on Windows”, your phone’s name, “this phone”) with a Sign out for each, and Sign out everywhere, which ends every phone and browser signed in as you. The phone app has the same.
- Deactivating a user, setting a temporary password or resetting a password signs that person out everywhere at once.
Updated on 29 October 2026