One click, nothing to type
Open the sign-in page and press “Open an example workspace”.
Where it lands: Signed in as an example director holding six companies, from fully up to date to years behind.
Open the sign-in pageREVIEWER ACCESS
Three ways in, and what an account actually is
There is no password anywhere in this build, so nothing below is a secret. Every account, session, company and ticket is a durable row you can inspect.
Getting into the signed-in surface
Any email address
Enter any address. A six-digit code is generated and shown on screen, because this deployment sends no email. Type it into the field — it is deliberately not filled in for you.
Where it lands: A fresh account seeded with the same six companies, so the demo route and your own route show the same product.
The code is random, hashed before storage, expires in ten minutes, allows five attempts and works once. “Send a new code” issues a genuinely different one and retires the old.
Open the sign-in pageContinue with Google
The authorization-code flow is implemented, with a one-time state cookie, an open-redirect guard, an audience check and a refusal for unverified addresses.
Where it lands: Nowhere on this deployment.
NOT AVAILABLE HERE, and the button renders nothing rather than failing: no client secret is configured and the consent screen is still restricted to one organisation. Stated rather than hidden, because a sign-in button that cannot work is worse than an absent one.
Four different things, four different tables
A portal that treats these as one is how a person comes to believe that signing in filed something. Each has a different owner, a different lifetime, and a different consequence when it is lost.
A browsing session
guest_sessions- Who it belongs to
- A browser. No name, no email, no identifier.
- How long it lasts
- Thirty days in a cookie, or until you clear it.
- What it gets you
- Everything that does not belong to a person: the calculators, the catalogue, the service finder, the guide, and a grievance ticket.
- What is lost without it
- You lose the thread of what you were doing. Nothing that was owed changes.
A gateway account
users · auth_sessions_v2 · user_profiles- Who it belongs to
- A person who verified an email address. This is NOT an MCA account and carries no statutory identity.
- How long it lasts
- Until you sign out. The session is hashed and expiring; the account persists.
- What it gets you
- The workspace: the companies you hold, what each owes, and your own applications.
- What is lost without it
- Nothing is deleted. Sign in again with the same address and the same workspace is there.
A company registration
companies · name_reservations · filings- Who it belongs to
- A company record created through the incorporation journey, held by an account.
- How long it lasts
- Permanent, and demonstration-only — the CIN is not issued and resolves to nothing.
- What it gets you
- An exposure computation on real dates, a name held with its validity clock, and SRNs with their three separate countdowns.
- What is lost without it
- Nothing real. No registration performed here has any legal effect whatsoever.
A grievance ticket
support_tickets · support_ticket_events- Who it belongs to
- Whoever raised it — a signed-in account, or just a browser, because someone locked out of login must still be able to report it.
- How long it lasts
- Until it is withdrawn by you or disposed of by an officer. The history is append-only.
- What it gets you
- A reference number, a status, and a service standard the ticket is measured against.
- What is lost without it
- The reference resolves only from the browser or account that raised it, so losing both loses the ticket.
Check it rather than believe it
The storage endpoint enumerates every table in the database with its purpose, its columns, its row count and the timestamp of its newest row. It is the same data this page describes, read from the running database rather than written here.
Never enter real credentials. No DIN, PAN, password or genuine company identifier should be typed into this prototype. Nothing here is filed, paid or submitted, and no account created here has any standing with the Ministry. The real MCA login is the only place an MCA identity exists.