Signing in

Signing up and signing in

The sign-up form asks for your name, your organisation (it becomes the workspace name), your role from a list of twelve, and — optionally — what you sell to government and your ABN, then a work email and a password. Personal email providers such as Gmail and Outlook are not accepted. Signing up from an invitation skips the organisation, role, what-you-sell and ABN questions, because you are joining a workspace that already exists. Your role and what you sell are shown on the Account page and decide nothing. The ABN must be a valid one (the form checks its digits) and is used for your first Bower briefing only; to link it to your company, use Your company. The panel beside the sign-up form lists what the trial includes; the sign-in, password and invitation pages carry only their form.

After the form, we email a confirmation link. Opening it confirms your address and takes you to the sign-in page ("Your email is confirmed. Sign in to continue."); sign in with your email and password to start. The link does not sign you in by itself, so a company mail scanner that opens it first cannot end up as a device on your account. If the email does not arrive, look in Junk, or ask your IT team to allow mail from noreply@bidnomy.com.

Sign-up, sign-in and password reset each carry a Cloudflare Turnstile check. Most people see a brief tick and nothing else; if the check fails, the form says so and lets you try again.

Free trials per company

Each company can start a set number of free trials. The company is your email address's domain — everyone at acme.com.au, including sales.acme.com.au, is one company. While your company is under that number, you get your own trial when you sign up, even if colleagues already use BidNomy.

Past it, signing up still creates your account and you can sign in — you just don't get a trial. The Home page says why:

• "Your company has BidNomy on a team plan" — a colleague's organisation is on Team or Enterprise. Its owner and administrators get an email with your address and a link that fills in the invitation on their Team page; you are never told who they are. When they invite you, the invitation shows on your Home page with a Join button.
• "Your company has used its free trials" — choose a plan on Billing.
• "Free trials are paused" — choose a plan on Billing.
• "This address has had its free trial" — one trial per person, ever, even after deleting the account. Choose a plan on Billing.

There is no limit on how many paid accounts one company has. If more trials open up for your company later, your trial starts the next time you open BidNomy. Somebody who signs up from an invitation is never affected.

Signed in on two devices

On Essentials, Pro and the trial you can be signed in on two devices (browsers) at a time. Signing in on a third asks "Continue here?" and names the other device — the browser and roughly where it signed in. Continue here signs out the older of the two and lets you in; Not now signs this browser out and leaves the other two alone. The device that was signed out shows "You were signed out because this account signed in on another device." the next time it opens a page, with a link to sign in again. Signing out from the account menu frees the slot at once. Team and Enterprise have no limit.

Trusted devices

On Essentials, Pro and the trial you keep up to two trusted devices. Signing in on a new one asks for a code we email you; a passkey sign-in, or a sign-in that already took a two-step code, counts too. The device you were using when this started, or when you signed up, is trusted already.

The Account page lists your trusted devices with Remove. A removed device asks for a code next time; putting it back is free. Adding a new device when you already have two replaces the one you used longest ago, and counts as a device change: you have three a month. After that a new device is asked to contact support, and your trusted devices keep working. Team and Enterprise have no device limit.

Unusual sign-ins

We watch for signs that a login is shared or has been taken over: the same account signed in from places too far apart to travel between, many new devices in a week, or "Continue here" used again and again. Nothing is ever banned or locked automatically. Each new sign makes one gentle step, in this order: your other sessions are signed out, we email you a warning, and every device asks for a code again. That is as far as it goes on its own; quiet months walk the steps back, one a month. If it keeps happening, our team may review it and make the account read-only until you contact support. You can still read records and reach support while it is read-only. Team and Enterprise accounts are only flagged for our review.

Two-step verification

Two-step verification is optional, and it is yours rather than the organisation's: each person turns it on for their own password sign-in. With it on, signing in with your password also takes a six-digit code. We email the code to the address on your account after your password. You can also add an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, 1Password or another app that makes these codes — and use its code instead.

Because a code can always be emailed to you, two-step verification protects your account as well as your mailbox does: somebody who learns your password still cannot sign in without your email (or your phone, if you added the app). The app is a convenience, and it works when an email is slow to arrive.

Turning it on. The Two-step verification block on the Account page has Turn on. We email a six-digit code to your address; enter it and press Turn on. The block then says "On since" and the date. Any other device you are signed in on is signed out, and asked for a code when it signs in again.

Adding an authenticator app. Once it is on, Authenticator app has Add app. Add a new account in your authenticator app, scan the QR code the page shows (or type the setup key if you cannot scan), and enter the six-digit code the app shows for BidNomy. From then on the app's code is asked for first when you sign in with your password.

Signing in with a password. After your password, a second step titled "Enter your code" asks for it. Without the app, a code is emailed to you straight away: it works once, for 10 minutes, and send a new code becomes available after a minute (up to five codes an hour). Its countdown shows the time left; reloading while a code is still recent keeps the remaining wait rather than starting another minute. With the app, enter the code it shows now (it changes every 30 seconds), or choose Email me a code instead. A wrong code keeps you on that step with a message, and Sign out is there if you want to stop. A confirmation link from an email asks for the code too before it opens the workspace.

Resetting your password. A "Reset your password" email lets you choose a new password without a code, and then signs you out everywhere. Your next password sign-in asks for the code as usual.

Lost your authenticator? Choose Email me a code instead when you sign in, then remove the app under Authenticator app › Remove, confirming with an emailed code. You can add it again on a new phone.

Turning it off. Turn off asks for a code — from the app if you added one, or by email — and turns off both the email codes and the app. After that your password alone signs you in.

API keys are not asked for a code, and a key made before you turned it on keeps working until you revoke it.

Passkeys

Passkeys are managed on the Account page under Two-step verification, below Authenticator app. They remain available when two-step verification is off.

After you finish an email or app code at sign-in, we offer Set up passkey if your browser supports it and your account has none. Choose Not now to continue where you were going, including an invitation. Cancelling setup lets you retry or skip. Once you have a passkey, this offer is skipped.

A passkey signs you in without typing your password. Your device asks for your fingerprint, face, device PIN or security key; BidNomy never receives your biometric information. You can keep several passkeys, and your password remains available.

Add one. Sign in, open the Account page, then Two-step verification › Passkeys, and choose Add passkey on a device you trust. Follow your device's prompt, then Rename the key so you recognise it. The list shows when each key was added and last used. Passkeys need a supported browser and the main site at https://bidnomy.com. Your password manager or device decides whether a key syncs to your other devices.

Use one. On the sign-in page, complete the security check and choose Sign in with a passkey. Verify your fingerprint, face or device PIN. An approved passkey completes sign-in without a password or separate email/app code. A key that cannot verify you this way cannot complete passkey sign-in; use your password and code instead. Cancelling the device prompt lets you try again.

Existing keys. A key added before this change, or outside BidNomy's Account page, needs approval once. Sign in with that key. If two-step verification is on, enter your email/app code, then choose Approve this passkey. Only the key you just used is approved. Not now continues sign-in and leaves codes required for that key next time. Newly added Account keys are approved when setup succeeds.

Rename or remove. Use the controls beside a key on the Account page. Removing the last key still leaves your password. If you have an authenticator app but signed in using email codes or a passkey, adding or removing a key first asks for your app's code in a dialog. Verify it, then retry the change.

Lost a device? Sign in with your password and code, or another approved passkey, then remove the lost device's key. Resetting your password signs out sessions; it does not remove or unapprove your passkeys. Remove any key you do not recognise from the Account page. Removing a key stops future sign-ins with it; an already issued access token keeps its normal expiry.