Secure, and out of your way.
Anyone can browse every home on LiNK without an account. You only need to sign in when you want to do something — save a property, request a showing, place a bid, list a home, or offer your services.
Enter your email and password, or use a validated login below.
or continue with
Email, Google, Apple, and Microsoft are the four supported sign-in methods. Whichever you use, the address behind it is verified before the account can transact.
New to LiNK? Create an account
Step 2 of 2
MFA is required for every LiNK account, not offered as an option. After the password step, one of three methods confirms it is really you.
We sent a six-digit code to sample.user@example.com.
A CAPTCHA appears after multiple failed sign-in attempts. Keep failing and the account is locked, and the automated "let us help you reset your account" email goes out.[ TODO — needs client decision ] Login spec does not name the CAPTCHA vendor, the failed-attempt threshold, or the lockout duration.
Every state the spec names, rendered side by side so the wording can be reviewed without having to trigger each one. On the real page only one appears at a time, in the form, announced to screen readers.
That email and password combination doesn't match an account. Check both and try again.
Deliberately generic. The spec is explicit: do NOT tell the user whether the email exists — the same sentence must answer a wrong password and an unknown address.
For your security this account is locked. We've emailed you a link to reset your password and get back in.
Lockout triggers the automated “let us help you reset your account” email, and MFA is required on the next successful sign-in.
We still need to confirm this email address. Check your inbox for the verification link, or request a new one.
Every login method — email, Google, Apple, Microsoft — must be validated before the account can transact.
Your password has expired. Set a new one to continue.
Spec names the state but not the expiry interval.
Too many attempts from this device. Try again in 15 minutes, or reset your password now.
CAPTCHA appears after multiple failed attempts; this message follows it.
Never tell the user whether an email address exists. Sign-in, password reset, and account recovery all return the same neutral response for a known and an unknown address. An enumeration oracle is how attacker lists get built.
[ Straight from the Login spec: "Do NOT tell the user that their email exists or not". ]
Locked out, or the password has expired? The whole path is automated — no support ticket required.
Ask for a reset from the sign-in form. We send the same confirmation whether or not the address has an account, so the form never confirms an email exists.
A single-use code, valid for a short window, proves the inbox belongs to you before anything can change.
The new password must clear the same strength rules as sign-up, and cannot reuse the password being replaced.
Every other session is ended, and the next sign-in runs multi-factor authentication from scratch.
Recognized devices skip the second factor for the length of the remembered period. Everything else is logged, and anything unusual is flagged.
| Device | Location | Last seen | Status |
|---|---|---|---|
| This deviceMacBook Pro · Safari | Richmond, VA | Now | Current session |
| iPhone 15LiNK app · Face ID | Richmond, VA | Today, 7:42 am | Trusted |
| Windows PCChrome | Henrico, VA | Aug 3, 2026 · 6:15 pm | Recognized |
| Unknown deviceChrome · Linux | Ashburn, VA | Aug 1, 2026 · 2:09 am | Unusual activity |
Unusual login activity detected. A sign-in from Ashburn, VA on an unrecognized Linux device on Aug 1. If that was not you, reset your password and log out of all devices.
The spec is explicit: the system works out the role after authentication and routes accordingly. A buyer lands on the buyer dashboard without ever being asked what they are. Where an account carries more than one role, LiNK opens the most recently used one and offers the rest.
Saved homes, showings, bids, and the mortgage calculator.
Buyer dashboard →
Listings, offers, showings, and portfolio performance.
Seller dashboard →
Company profile, services, coverage area, and reviews.
Provider onboarding →
Already signed in? Go straight to your profile, or to buyer settings.
[ Administrator and Customer Service Representative roles exist in the Profile spec but have no destination in this prototype yet. ]
Idle sessions end automatically and require a fresh sign-in. The spec proposes 30 minutes with a question mark.[ TODO — needs client decision ] Login spec: 'Session timeout after inactivity (30 min?)' — the value is the client's own open question.
Passwords are hashed, never stored or logged in readable form, and never visible to LiNK staff or to a service provider.
Repeated failures lock the account, send the automated reset email, and force multi-factor authentication on the next successful sign-in.
Built to WCAG 2.2 AA, which is the standard ADA claims are measured against in practice.
Every control on this page is reachable and operable with Tab, Shift+Tab, Space, and Enter. Focus is never trapped and never invisible.
Fields carry real labels, errors are announced through live regions, and each section is named with aria-labelledby.
Text and controls are drawn from the token palette, which meets WCAG 2.2 AA contrast, and nothing relies on color alone.
Errors say what happened and what to do next, in the same place the mistake was made.
This applies to every page on LiNK, not only sign-in.
[ VERIFY: the spec asks us to check current ADA law and recommendations. WCAG 2.2 AA is the working target; confirm with counsel. ]
Biometric unlock in the LiNK mobile app, standing in for the password once the device is trusted.
Fields carry the standard autocomplete tokens so a password manager can fill them.
Every button and link clears a 44px minimum target.
One column below 880px; the form never sits behind a keyboard.
[ Face ID / Touch ID require the LiNK native app; they are not available to a browser sign-in. Scope of the mobile app is outside this prototype. ]
