XiriGo Admin DocsLogin & Authentication
How to log in to the XiriGo Admin Panel and manage your session.
Login & Authentication
The XiriGo Admin Panel is a protected application accessible only to authorized administrator accounts. There is no self-registration; admin accounts are created by existing super administrators.
Accessing the Admin Panel
Navigate to your admin panel URL (typically https://admin.xirigo.mt) in a modern web browser. You will be presented with the login screen.
Provide your registered email address and password in the login form. These credentials are assigned when your admin account is created.
Click Sign In. The system validates your credentials against the backend authentication service.
Upon successful authentication, you are redirected to the Dashboard with full admin capabilities based on your assigned role and permissions.
Session Management
The Admin Panel uses JWT (JSON Web Token) based session management for secure, stateless authentication.
| Aspect | Detail |
|---|---|
| Token type | JWT access token + refresh token |
| Access token lifetime | 15 minutes |
| Refresh token lifetime | 7 days |
| Storage | HTTP-only secure cookies |
| Auto-refresh | Tokens are silently refreshed before expiration while you are active |
Your session will remain active as long as you interact with the panel within the refresh token window. After 7 days of inactivity, you will need to log in again.
Security Requirements
- HTTPS only — The admin panel is served exclusively over HTTPS. HTTP connections are automatically redirected.
- Strong passwords — Admin passwords must meet minimum complexity requirements (uppercase, lowercase, number, special character, minimum 12 characters).
- Rate limiting — Failed login attempts are rate-limited to prevent brute-force attacks. After 5 consecutive failures, the account is temporarily locked for 15 minutes.
- IP logging — All login attempts (successful and failed) are recorded with IP address and timestamp in the Audit Log.
Logging Out
Click your profile avatar in the top-right corner of the header bar and select Logout. This invalidates your current session tokens on both the client and server side.
Always log out when using a shared or public computer. Closing the browser tab alone does not invalidate your session.
Forgotten Password
If you forget your password, contact an existing super administrator to reset it. Password reset is performed through the admin user management interface under Settings > Admin Users.
For security audit purposes, all login events, session creations, and logouts are recorded in the Audit Log. You can review your own login history from the audit module.