Account setup and sign in

Sessional Australia is built for AHPRA-registered locums and independent contractors: GPs, specialists, pharmacists, nurses, physiotherapists, psychologists, occupational therapists, dentists, and paramedics. On the sign-up page you enter:

• First name and Last name: how you appear on invoices and in the directory
• Email address: the address you use to sign in and receive account emails
• Profession: choose the profession for your profile
• Password: at least 10 characters, including a letter and a number, up to 72 UTF-8 bytes; common passwords are rejected

You can add your AHPRA number during sign-up or leave it for later on the Professional tab of your profile. Standard sign-up creates your locum profile and a referral code. You start on Free unless an eligible trial code applies.

After signing up you receive a verification email with a confirmation link. Clicking it activates your account and unlocks your dashboard. A few things worth knowing:

• The verification link is valid for 24 hours
• You cannot reach your dashboard until your email is verified
• If the email has not arrived, check your spam or junk folder first
• You can request a fresh verification email from the verification page

Some hospital and health-service mail systems quarantine or delay external email, so if you signed up with a work address and nothing appears, ask your IT team to allow mail from sessional.com.au, or use the contact page for help.

There are two ways to get back into your account, and you can use whichever suits the moment:

• Password: enter your email and password on the sign-in page.
• Magic link: enter your email and we send a one-time sign-in link. Click it and you are in, no password needed. Magic links expire after 15 minutes, so request one when you are ready to use it.

Forgotten your password? Use the "Forgot your password?" link on the sign-in page. We email a reset link that lets you set a new password. For security, sign-in, magic-link, and password-reset requests are rate limited, so if you try many times in a row you may be asked to wait before the next attempt.

Change your sign-in email from the Account tab of your profile. The change uses a confirmation step before the new address replaces the old one. Enter your current password, or use Send verification to current email if your account has no password:

1. A confirmation link is sent to the new address
2. Your account keeps using the old email until the new one is confirmed
3. The confirmation link is valid for one hour
4. Once you confirm it, all active sign-ins are signed out. Sign in again with the new email

If the new address already belongs to another Sessional account, nothing changes and no mail is sent to that address. That is a deliberate privacy measure, not a glitch.

Change your password from the same Account tab. You must enter your current password before choosing a new one. The new password follows the same rules as sign-up. If your account has no password, the Account tab links to the password-reset flow to set one.

When the change succeeds, every other active sign-in is signed out and we email you a security alert. You stay signed in on the device you used to make the change; any other device has to sign in again.

Sessional takes several measures to protect your account behind the scenes:

• One-way password hashing: Sessional stores a bcrypt hash for password authentication.
• HTTP-only session cookies: the authentication cookie is marked HTTP-only.
• Encrypted records: sensitive details such as your AHPRA number, ABN, and bank details are encrypted at rest.
• Session revocation: changing your password revokes other active sign-ins; confirming an email change revokes all active sign-ins.

You can request account deletion from the Account tab. Deletion is scheduled 30 days ahead rather than happening instantly, which gives you a grace window to change your mind. During that window you can cancel the request from the same screen and your account carries on as normal. Cancellation remains available until the deletion job begins processing the request. We email you a confirmation when you request deletion.