Signing In

Sign in at /auth/sign-in. The page is headed "Log in to Greenroom" and reads "Use the email and password for your Greenroom account." Under the form, two lines are for a first visit: "First time here? Use the link in your invite email — it sets up your sign-in.", and "Running payroll for a production?" with a Create your company link to the sign-up form.

Payees (the cast, crew, and vendors your production pays) sign in on this same page, but they land in their own payee portal, which this documentation doesn't cover. When a payee arrives from the portal, the page speaks to them instead, with no Create your company line: "Use the email and password from your payee account.", and for a first visit, "Open the invite link your production sent you — it sets up your sign-in." A payee's account always comes from that invite link, never from the sign-up form.

One login can be both. If you run payroll for a production and a production also pays you through Greenroom, signing in asks "You run payroll for a production and you are paid through Greenroom. Where would you like to go?", with Manager dashboard and My pay, unless you followed a link to a particular page. My pay is in the sidebar too.

If you work in more than one company, signing in, or setting a new password, takes you to Choose a company first, unless one of them is already open in this browser (see Choosing a company). Manager dashboard, on the question above, takes you there too whenever Greenroom has to ask which company to open.

Your plaintext password is never stored — only a secure hash of it. Once you're verified, Greenroom keeps you signed in and checks that your session is still valid on every request, so it can sign you out immediately when needed: completing a password reset, for example, signs out every other session you had open at once.

Leave the page idle for 30 minutes and Greenroom warns you 60 seconds before it signs you out. The warning reads "You'll be signed out in 60 seconds", with "For your security, Greenroom signs you out after 30 minutes without activity. Changes you haven't saved may be lost." Stay signed in keeps the session going; Sign out ends it now. If you're still idle when the countdown ends, the page signs itself out, and the sign-in page says "For your security, you were signed out after 30 minutes without activity." Signing back in returns you to the same page, and work you hadn't saved — a payee edit or a payroll entry — is offered back, because an automatic sign-out keeps those drafts in the browser. The drafts expire on their own (24 hours for a payee edit and review notes, 12 hours for run entries), and Sign out, from the warning or any sign-out control, clears them.

Each sign-in also lasts at most 12 hours, however active you are. Five minutes before that limit a warning reads "Your sign-in ends in 5 minutes", with "For your security, each sign-in lasts 12 hours. Save your work, then sign in again to keep going." Sign in again takes you through sign-in and back to where you were, and Not now dismisses the warning. When the 12 hours are up the page signs out, and the sign-in page says "For your security, each sign-in lasts 12 hours. Please sign in again."

Passkeys

Below the password form, sign-in also offers Use a passkey — a usernameless option that uses your device's built-in authentication (Face ID, Touch ID, Windows Hello, a security key) instead of typing an email and password. If you've registered a passkey from Settings → Me, this signs you straight in: possession of the passkey plus your device's own verification (fingerprint, face, PIN) stands in for both your password and your second factor, so it skips the two-factor step below entirely.

Two-factor authentication

If two-factor authentication is on for your account, a correct password alone won't sign you in. You'll be prompted for a second factor: a code from an authenticator app, a one-time code emailed to you, a passkey, or a recovery code. Setting up, managing, and recovering these methods is covered in Authentication & Recovery Codes.

Two-factor is on from the start for an account created at sign-up, by Greenroom, or from a team invite. A teammate invited from Settings → Team before team invites started with it on (October 19, 2026) has it off, and can turn it on under Sign-in security on Settings → Me.

If you turn two-factor sign-in off, Greenroom asks you to confirm that signing in will need only your password, records Two-factor sign-in turned off on Settings → Activity, and emails you a security notice. See Turning two-factor sign-in off for the confirmation and email.

How your password gets set

There's no general-purpose "create an account" form — a password only ever gets set one of four ways:

• Starting a new company. You choose your own password on the sign-up form.
• Greenroom setting up your company for you. Greenroom emails you "You've been added to Greenroom — set your password". Its Set your password button opens a page where you choose a password and click Activate account. The link works once and expires after 7 days (if it has, see below). Once your password is set, you enter the sign-in code Greenroom emails you, and you land where your company's setup picks up (see First Steps).
• Accepting a team invite. An Admin invites you from Settings → Team, and Greenroom emails you "[their name] invited you to [company] on Greenroom". The email names your Admin, Payroll, or Approver role. Its Set your password button opens the same page: choose a password and click Activate account. Then enter the sign-in code Greenroom emails you (subject "Your Greenroom sign-in code") and click Verify and sign in. Your role and your company's setup progress determine where you land. If you were invited before team invites started with two-factor on (October 19, 2026), it's off on your account, so setting your password signs you straight in. The link works once and expires after 7 days, and a newer invite replaces it, so use the newest email. If you were invited with a temporary password instead, it keeps working until you set your own.
• Resetting a forgotten password. See below.

Whichever way it's set, the rule is the same: at least 10 characters. Greenroom doesn't require a specific mix of uppercase letters, numbers, or symbols — length is what's enforced.

If your link has expired or never arrived

A link to set your password that has expired, been used, been replaced, or been cancelled when your access was removed opens a page headed This link has expired: "Links to set a password work once and only for a limited time, and stop working if your access is removed. If you’ve already set yours, sign in. If not, ask the person who invited you to send another, or use “Forgot your password?” to get a new link by email." Under it are Forgot your password? and Sign in. If the link stops working while the page is open, Activate account shows "This link has expired or no longer works. Ask the person who invited you to send another, or use “Forgot your password?” to get a new one by email. If your access was removed, only they can restore it.", with a Forgot your password? button.

If your company access is still active, there are two ways to a working link:

• Forgot your password? emails you a link to set your password yourself. It lasts an hour (see Forgot your password) and replaces any unused invite link. It works even if you've never had a password of your own: an invite that never arrived, or a team invite that came with a temporary password.
• Ask for another. For a team invite, an Admin presses Resend invite on your row in Settings → Team. A manager Greenroom set up asks Greenroom.

If you were deactivated before you set your password and have no active access to another company, the old invite is cancelled. Resetting your password cannot restore company access. Ask an Admin to reactivate you, then use Resend invite. Reactivating access doesn't restore the old link.

If an invite never arrives at all, check your spam or junk folder for an email from noreply@greenroompayroll.com first.

Forgot your password

Click Forgot your password? on the sign-in page and enter your email. Greenroom's response is identical either way — "If an account exists for that address, a reset link is on its way" — regardless of whether that email is actually registered, so this step can't be used to check who has an account.

If your account is active and eligible for a password link, a one-time reset link arrives by email (check spam if it doesn't show up within a minute or two). A removed invitee must have access restored as described above. The link expires in 1 hour and works once. An expired or used link opens a page that reads "Password reset links work once and only for an hour. Ask for a new one and use it within the hour.", with Get a new reset link, which brings you back to this form. Completing it sets your new password and signs you out of every other session you had open. If two-factor authentication is on for your account, you confirm your second factor next, as at sign-in. Your role and your company's setup progress determine where you land next.

If you're locked out

After 5 incorrect password attempts, Greenroom locks the account for 15 minutes — you'll see "Too many attempts. Try again in 15 minutes," and during that window even the correct password is rejected. Two ways out:

• Wait. The lock clears itself automatically once 15 minutes have passed.
• Reset your password. Completing the Forgot your password? flow above clears the lockout immediately, so you don't have to wait it out.

If neither works, the sign-in page has a Trouble signing in? link to hello@greenroompayroll.com.

Even an Admin can't unlock a teammate's account, see their password, or clear their lockout from inside Greenroom. From Settings → Team, an Admin can resend an invite to an active teammate who hasn't set a password yet, or deactivate and reactivate company access within the Team rules. Changing company access doesn't clear a password lockout. A teammate who already set their password and is then deactivated from every company can still sign in, but sees No production has added you yet instead of the app, with a Sign out button; one whom a production also pays through Greenroom lands on their pay instead.

A payee is different. If you're an Admin or Payroll teammate and a payee has an active Greenroom login, their start-work packet card shows Send password reset, which emails them the same one-hour reset link ("Password reset emailed to [email]. The link works for one hour."). It isn't offered for an archived payee, and Greenroom staff viewing your company can't send one. A payee who signs in with a login that also runs a production can't be sent one from here; the refusal says they can reset it themselves with Forgot your password? on the sign-in page.

If you're locked out of your second factor instead — you've lost your authenticator app or passkey and don't have a saved recovery code — that's a different situation with a different fix; see Authentication & Recovery Codes.

Next steps

Once you're signed in, continue with First Steps to finish setting up your company.