Sign-in and Accounts

Job-seeker accounts are what unlock matches, saved jobs, profiles, alerts, and applying behind a registration wall. This page covers how job seekers sign in and verify their email. Everything here also applies to the account types built on it elsewhere in this section. After they are signed in, they manage password, email, and account deletion from Account settings.

Sign-in methods

Your board offers four built-in ways to sign in, and all four work out of the box:

• Email and password.
• Magic link, a passwordless link emailed to the person signing in. The link is valid for 15 minutes.
• Google. Available by default, running on Cavuno's own credentials.
• LinkedIn. Available by default, running on Cavuno's own credentials.

You can also add SSO connections, so people sign in with your organization's sign-in (for example a member system or a company identity provider). SSO works with Okta and with any member system or identity provider that supports OpenID Connect or OAuth 2.0.

Choose methods for candidates and employers

Go to Settings → Sign-in methods. One table lists Email and password, Magic link, Google, LinkedIn, and each SSO connection. Every row has a Candidates switch and an Employers switch, so each role can use a different set of methods. Your board's sign-in page shows only the methods switched on for that role.

Switching a method off does not sign anyone out. People who are already signed in stay signed in; the change applies the next time they sign in.

Use your own Google or LinkedIn credentials

You do not need to create an OAuth app for Google or LinkedIn. If you want the consent screen to show your own domain, open the row's ⋮ menu and choose Use your own credentials. This needs a custom domain. If you saved your own credentials and no longer have a custom domain, the same menu lets you remove them. See Google sign-in setup and LinkedIn sign-in setup.

Add an SSO connection

1. Click Add SSO connection. Choose your Provider: Okta, or Other provider (OpenID Connect) or Other provider (OAuth 2.0) for anything else. Not sure which? Ask your IT team or member system which of these it supports. Enter your organization's name.
2. Copy the callback URL into your provider as a sign-in redirect URI, exactly as shown.
3. Paste back the issuer URL, client ID, and client secret from your provider. Use the secret's value, not its ID.
4. Optionally add a logo. The preview shows the Continue with … button people will see.
5. Under Who can use it, switch the connection on for Candidates, Employers, or both, and choose what happens the first time someone signs in.
6. Click Test connection and sign in to your provider in the window that opens. The test uses exactly the settings in the form. When it passes, View what … sent lists what your provider sent; when it fails, the form says what to fix.
7. Click Save. Save stays unavailable until a test passes on the settings in the form.

Close the drawer before saving and nothing is added.

Step-by-step guides: Set up SSO with Okta and Set up SSO with any OpenID Connect or OAuth 2.0 provider. If a test fails, see Troubleshooting SSO.

Edit an SSO connection

Click the connection in the table, or choose Edit from its ⋮ menu. You can change the name, logo, who can use it, and what happens for new people, then save without testing again. Changing a provider setting (issuer URL, client ID, client secret, or anything under Advanced) needs a new passing test before Save: the form says Test again to save your changes. Until you save, sign-ins keep using the previous settings.

To replace the client secret, click Replace. The saved secret shows only its last four characters.

Advanced holds the protocol, discovery URL, scopes, and claim names. It also has Trust the provider's email, which is off by default. If a test shows your provider confirms verified emails, you do not need it and the form says so.

To remove a connection, open its ⋮ menu in the table and choose Remove.

A connection is in use once it has been saved after a passing test and is switched on for a role.

Make a role SSO only

To have a role sign in only with SSO, switch on an SSO connection for that role, then switch off every other method for it. Cavuno asks you to confirm. Tick Sign them out now to also sign out people in that role who have not linked SSO yet; otherwise they stay signed in until their session ends, and sign in with SSO next time.

Every role keeps a way to sign in

Each role always keeps at least one working method, so you cannot lock people out by accident:

• The last method switched on for a role cannot be switched off.
• An SSO connection that is a role's only method cannot be switched off or removed until another method is switched on for that role.

Sign people out

The ⋯ menu at the top of the page has Sign out candidates… and Sign out employers…. Choose to sign out only those who have not linked SSO, or everyone in that role. They can sign in again with any method still switched on for them.

Email verification

Email verification is required before a signed-in job seeker can reach any authenticated surface (dashboard, saved jobs, alerts, profile, or applying behind a registration wall):

1. After signing up or in, the job seeker is sent to a verify-email step.
2. Your board emails a 6-digit code that expires in 15 minutes.
3. They enter the code and continue to wherever they were headed.

If the code does not arrive, they can request a new one after 60 seconds.

Account settings

Signed-in job seekers (and employers) open Settings on your board to change or set a password, change email, or delete the account. Email change is confirmed at the new address before it takes effect. Deletion is permanent and does not remove companies from the board. See Account settings.

Availability

• Plan: All paid plans. Candidate accounts are available on every paid plan; your board itself is public from the Starter plan upward.
• Setting: Settings, then Features, then "Job seeker profiles" (this is the switch that turns job-seeker accounts on). Turning it off hides sign-in from your board.
• Setup required: None. The four built-in sign-in methods work by default. Using your own Google or LinkedIn credentials and adding SSO connections are optional, in Settings → Sign-in methods.

Limitations

• New candidate accounts default to a hidden profile until the job seeker chooses otherwise. The per-board default is hidden and is not exposed as a setting in the dashboard. See candidate profiles.

Example

For example, a job seeker who begins at a registration-wall prompt can choose Google, verify when required, and return to the application path. Their new candidate profile remains Hidden until they change its visibility.

Next steps

Point signed-in people to Account settings for password, email, and account deletion. Enable Job seeker profiles if they are not already on.