Log in

Work email and password

Same credentials as the rest of Kumir. Demo: fan@fameo.app

Login lands on Business talent

Default redirect is /business/browse, not athletes. Signup is the athletes landing.

Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. No open redirect.

Too many attempts wait

429 / login-hint shows Wait a few minutes. The password is never guessed for you.

Forgot password is shared

/forgot is the same reset flow as fan login. No invented Resend key.

Licensed prices after you sign in

Business browse shows talent businessPrice. SAG P&H may add at checkout.

Not personal /login

Fans use /login. This chrome stays on Kumir for Business.

Not Create a business account

No account? /business/signup. Login does not stamp businessBuyerAt.

Not talent enroll

/enroll is supply. Login does not open a studio queue.

SSO stays hidden until configured

Google/Apple buttons stay off until AUTH_GOOGLE_* / AUTH_APPLE_* exist. Never fake SSO.

Impersonation stays web-only

CS impersonation is a web admin tool. iOS and Android never impersonate.

The form never fakes a session

Sign-in verifies the password. It does not invent a browse session.