# RELATED_PERSON_LOGIN_ENABLED

Canonical page: https://docs.ovok.com/settings-and-features/settings/related-person-login-enabled

Controls whether [carers](/authentication/carers) can sign in to the project. It is the carers' own switch: [`PATIENT_LOGIN_ENABLED`](/settings-and-features/settings/patient-login-enabled) does not apply to them, and this one does not apply to patients.

| | |
| --- | --- |
| Type | Boolean setting |
| Change with | `PUT /v1/project/settings/RELATED_PERSON_LOGIN_ENABLED` |
| Who can change it | Project admin |
| When unset | Carer sign-in is **on**. `GET /v1/project/settings` reports `false` in `settings`, `null` in `overrides` and `true` in `effectiveSettings`. |
| Set on new projects | `false` for child projects created with `POST /v1/slim/project/child`; not set by any other project-creation route |
| Inherited | No. A child project reads only its own value. |

## Turn carer sign-in off [#turn-carer-sign-in-off]

```bash
curl --request PUT \
  --url 'https://api.sandbox.ovok.com/v1/project/settings/RELATED_PERSON_LOGIN_ENABLED' \
  --header "Authorization: Bearer ${OVOK_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '{"enabled":false}'
```

The response is the full settings record. Send `{"enabled":true}` to turn it back on.

## Where the switch applies [#where-the-switch-applies]

| Path | Checked? |
| --- | --- |
| `POST /auth/tenant/RelatedPerson/login/start` | Yes |
| Token refresh (`POST /auth/refresh-token`, and the refresh grant of `/oauth2/token`) for a carer's token | Yes |
| `POST /auth/tenant/RelatedPerson/login/mfa` and `login/token` | No |
| Accepting a carer invite (`POST /v1/invites/record-share/accept`) | No. That is [`RELATED_PERSON_INVITATION_ENABLED`](/settings-and-features/settings/related-person-invitation-enabled). |

## What callers see when it is off [#what-callers-see-when-it-is-off]

| Route | Status | Message |
| --- | --- | --- |
| `POST /auth/tenant/RelatedPerson/login/start` | `403` | `Login is not enabled.` |
| `POST /auth/refresh-token` | `403` | `Login is not enabled for this project.` |
| `POST /oauth2/token` (refresh grant) | `403` | `Login is not enabled for this project.` |

On the sign-in route, an unknown tenant code answers `404 Tenant not found.` before the switch is checked.

## Gotchas [#gotchas]

- **Turning it off ends sessions at the next refresh.** A carer who is already signed in keeps reading until the access token expires, up to 60 minutes.
- **A session code issued before the switch changed still works** at `login/token`.
- **It does not stop new carer accounts.** A new carer's account is made when they accept an invite, whatever this switch says. To stop that, turn off [`RELATED_PERSON_INVITATION_ENABLED`](/settings-and-features/settings/related-person-invitation-enabled).
- **Projects created with `POST /v1/slim/project/child` start with it off.** Turn it on before you let patients invite carers.
- **A refresh is let through on a blip.** If the switch cannot be read within 3 seconds at refresh, the token is renewed, so a short outage does not sign carers out.

## Related [#related]

- [Carers](/authentication/carers), the sign-in flow this switch controls
- [RELATED_PERSON_INVITATION_ENABLED](/settings-and-features/settings/related-person-invitation-enabled)
- [PATIENT_LOGIN_ENABLED](/settings-and-features/settings/patient-login-enabled)
- [Settings are not permissions](/settings-and-features#settings-are-not-permissions)