Safer and easier ways to sign in to SmartClass

May–August 2026 update

Account security should protect people without making everyday access difficult. Over the last few months, we have improved the ways users sign in, recover access, and understand what went wrong when a login does not work.

This update explains the features users can already see in SmartClass, the protections working quietly in the background, and the sign-in changes we are preparing for the future.

More ways to access your account

Sign in with a passkey

On supported browsers and devices, users can add a passkey from their SmartClass account settings and use it to sign in without typing their SmartClass password. A passkey uses the screen lock already protecting the device, such as a fingerprint, face check, device PIN, or security key.

Passkeys are resistant to many common password-stealing attempts because there is no reusable password to type into a sign-in form. Users can give each passkey a recognizable name, add more than one device, and remove a passkey they no longer use. The ordinary password option remains available.

Get a single-use temporary password

If a user needs quick access but cannot use the usual password, the SmartClass login page can send a six-digit temporary password to the email address registered with the account. It is valid for 15 minutes and can be used only once.

Requesting another temporary password cancels the previous one. After the temporary password is used, it cannot be reused by anyone else. This provides a quick recovery option without changing the user’s permanent password.

Reset a forgotten password by email

The existing Forgot Password option sends a private reset link to the email address registered with SmartClass. The link opens a page where the user can choose a new password.

For safety, reset links expire after 24 hours. Requesting a new link replaces older links for the same account, and a successfully used link is removed. If a link has expired or is no longer valid, the user can request another one from the login page.

Recent improvements users may notice

A clearer and more dependable login experience

We refreshed the login and recovery screens so the next step is easier to understand on both desktop and smaller screens. Redirects after a successful login were corrected, and recovery screens now provide clearer success and error messages.

Better handling when a passkey is cancelled or unavailable

A passkey request can be cancelled, time out, or be unavailable on a particular browser or device. SmartClass now handles these situations more carefully so users receive a useful result instead of an unclear browser error. If passkeys are not supported, users can continue with their password or another recovery option.

Faster support when a sign-in fails

Sign-in steps can now be followed more consistently across SmartClass. This helps our support team locate where a problem occurred without placing passwords, temporary passwords, reset links, or other private sign-in details in ordinary diagnostic records.

Safer account setup and identity matching

Newly created staff and guardian accounts receive controlled account-setup links rather than readable passwords being stored for later use. When SmartClass is connected to an external identity service, the connection uses the exact verified identity and the correct organization—not an email address alone. Conflicting or inactive connections stop safely for review.

Which sign-in option should I use?

• Password: Continue signing in normally if you know your password and prefer the familiar method.
• Passkey: A convenient choice on a trusted personal device when you want to sign in without typing a password.
• Temporary password: Use the six-digit, single-use password sent by email when you need short-term access without replacing your permanent password.
• Forgot Password: Use the emailed reset link when you want to create a new permanent password.

Protections working behind the scenes

SmartClass also applies tighter checks around headquarters, campus, school, academic season, and user role. Seeing a menu item or selecting a school is not enough by itself; the server still checks whether that person or connected service is allowed to access the requested information.

Connections used by other systems are being separated from personal user accounts. Each connection can have its own owner, purpose, and limited access. New connection secrets are shown only when created, and administrators can rotate or revoke them without changing a staff member’s account.

What is coming next?

More modern sign-in through OAuth

OAuth is a widely used way for trusted services to confirm identity and request limited access without sharing a person’s SmartClass password. SmartClass has established the foundation for these connections and is testing them in a controlled way.

Future work will gradually modernize web and mobile sign-in, improve session expiry and logout, and prepare stronger support for account recovery, passkeys, and additional verification when it is needed. These changes will be introduced in stages rather than through a sudden replacement of the current login experience.

A careful transition for connected systems

New system-to-system connections will increasingly use their own limited OAuth identity. Existing integrations will not be switched off without first confirming their owner, purpose, and current use. When a change is required, old and new connection methods will run together for a short verification period and the responsible administrator will receive advance notice.

Simple steps users can take

• Keep the email address on your SmartClass account current so recovery messages reach you.
• Never share a password, temporary password, passkey prompt, or reset link with another person.
• Only approve a passkey prompt that you started yourself.
• Remove passkeys for devices you no longer use.
• If an unexpected recovery message arrives, do not use its link; contact your institution or SmartClass Support.

Do users need to do anything now?

No immediate action is required. Password sign-in and the existing recovery options continue to work. Users who have a supported browser or device may choose to add a passkey from their account settings. Administrators and integration owners will receive advance notice before an upcoming OAuth change requires them to review or update a connection.