Authentication & Access Control

Target Audience: Staff, Partner Admins & Organization Admins

Authentication secures constituent records and restricts administrative access based on assigned user roles.

Overview

Dream Center Connect uses role-based authentication to secure access across mobile, web, and kiosk applications. Access methods vary based on user context:

graph TD
    Auth["Authentication"] --> StaffAuth["1. Staff & Admin Sign-in (Email & Password)"]
    Auth --> KioskAuth["2. Kiosk Device Authorization (6-Char Join Code)"]
    Auth --> VolAuth["3. Volunteer Shift Check-in (Mobile Phone Number)"]

---

1. Staff & Admin Sign-in

Staff members, Partner Admins, and Organization Admins authenticate using email credentials:

1. Open the Dream Center Connect application or navigation portal.
2. Enter your registered Email Address and Password.
3. Click Sign In.
4. Upon verification, your secure session is activated and opens the corresponding workspace based on your assigned user role (Organization Admin, Partner Admin, or Staff).

Password Resets

If you forget your password, click Forgot Password? on the sign-in screen. A password reset link will be sent to your registered email address.

---

2. Kiosk Device Authorization

Physical check-in tablets operating in Kiosk Mode do not require individual staff logins.

• Join Code Authorization: Tablets are authorized by entering a 6-character Join Code generated by administrators under Admin Panel > Access Control > Kiosk Devices.
• Device Secret: Once paired, the kiosk securely stores a local device secret to validate punch requests without exposing administrative credentials.

→ Read Kiosk Device Pairing & Unpairing Manual

---

3. Volunteer Shift Check-in

• Phone Number Identification: Volunteers check in at paired kiosks or mobile screens by entering their 10-digit mobile phone number.
• No Portal Credentials: Volunteers do not require a password or portal login role to record shift check-ins.

---

4. Session & Security Policies

• Encrypted Transmission: All API requests carry encrypted Bearer tokens over HTTPS/TLS connections.
• Session Duration: Active user sessions remain signed in for standard daily operations until explicitly logging out via User Profile > Sign Out.
• Role Enforcement: User roles (Organization Admin, Partner Admin, Staff) determine accessible navigation tabs, constituent details, and administrative controls.