Report a claim · Prototype

[Product name]

Language

Report a claim

Enter the policy number and the plate on your policy. We'll send you a code to sign in.

No policy matches this number and plateCheck both against your policy document and try again.

We can't send you a codeYour policy has no email on file. Call the call centre to report your claim.

Sign-in paused for this policyToo many wrong codes. Try again in , or call 021-3199-9100.

Need help?021-3199-9100 · 24 hours

Need help?021-3199-9100

Need help?Contact Asuransi Demo's call centre

We only use your details to find your policy. Privacy

Use a different policy

We'll email you a code

Policy 01.203.2026.004512 · B 1234 XYZ, insured with Asuransi Demo.

We couldn't send your codeSomething went wrong on our side. Try again in a moment.

Sign-in paused for this policyToo many wrong codes. Try again in , or call 021-3199-9100.

The code works for 5 minutes.

Back

Check your email

We sent a 6-digit code to d************o@customer.test. It works for 5 minutes.

Didn't get it? That was the last resend. Start again for a new code.

This sign-in has ended

The code expired, or a wrong code was entered too many times. Start again for a new code.

/claim is public. ?policy= and ?plate= fill the fields as typed; bare /claim leaves them empty. A signed-in Client is not sent to Your policy.
The header is signed out on every step: the mark, "[Product name]" and the switcher. The switcher shows the language's code below 1024 px and its name from 1024 px. It changes the page's language in place and saves nothing: no cookie, no request.
POST /api/auth/client/policy {policyNumber, plate}. Nothing is checked before it is sent, so an empty field answers 400, "Some details aren't valid…".
404 IDENTITY_POLICY_NOT_FOUND marks both fields; the alert alone carries the text, and the first edit clears it. Its help box shows the fixed call centre, 021-3199-9100 · 24 hours, since no Insurer is known.
409 IDENTITY_POLICY_NO_CONTACT names the Insurer: its help box shows the Insurer's own call centre, or "Contact {insurer}'s call centre" when it has none.
429 IDENTITY_POLICY_LOCKED shows the paused alert above the form. Its countdown runs from retryAfter and reads "a moment" at 0; its number is the Insurer's own call centre, or the platform's when it has none. The fields stay valid and Continue stays on; the alert goes at the next Continue. It has no help box.
The lock: five wrong codes for one Policy within 15 minutes, across challenges, pause its sign-in for 15 minutes. While it holds, step 1 and Send code answer 429 IDENTITY_POLICY_LOCKED, and a code check or a resend answers 401 IDENTITY_CHALLENGE_EXPIRED.
Any other code is a form error above the fields, from errorCode, falling back by kind. No answer shows "We couldn't connect…", an empty answer "Something went wrong. Try again." 429 RATE_LIMITED shows "Too many attempts. Wait a moment and try again."; the limits are per IP each minute: 10 lookups, 10 sends, 30 code checks, 10 resends. Steps 2 and 3 show the same form errors.
POST /api/auth/client/sign-in {lookupId, channel: "email", client: "web", locale}. The locale is the switcher's, so the code email follows it. The email is masked one star per hidden character.
Backend offers SMS only when the Policy has a phone and an SMS sender is set. Production sets none, so the email is the only channel.
500 IDENTITY_CODE_NOT_SENT shows the not-sent alert, and a locked Policy the paused alert, as on step 1. The lookup lasts 15 minutes; after that, IDENTITY_CHALLENGE_EXPIRED is a form error on this step and does not switch to the ended card.
POST /api/auth/client/sign-in/code {challengeId, code}: 6 digits, valid 5 minutes, 5 attempts. 401 IDENTITY_CODE_INVALID gives the attempts left. The field checks on blur: "Enter the 6-digit code."
401 IDENTITY_CHALLENGE_EXPIRED (the wrong code that locks the Policy, the expiry, or a check or resend after either) shows the ended card; Start again goes back to step 1, where Continue meets the paused alert.
Resend: POST /api/auth/client/sign-in/code/resend once the countdown ends, at most 3 per challenge. 429 IDENTITY_RESEND_TOO_SOON is a form error and restarts the countdown. The third resend answers resendAfter: null: "That was the last resend. Start again for a new code." replaces the button, the code field stays, and no form error shows beside it.
A passed code sets the Client's Session cookies and goes to Your policy.

Email only, newer than main: the no-contact body, step 2 ("We'll email you a code", one Email card, its help line) and step 3 ("Back", "Check your email", "We sent a 6-digit code to …") come from client-sign-in.html (10 Oct, #628 and #395's amendment).
Main's copy everywhere else, including the no-contact help box with the Insurer's own number or "Contact Asuransi Demo's call centre" (#502, newer than the mockup's fixed number and "· 24 hours").
Main's frame: the shield mark and "[Product name]", the codes ID, EN, ZH and ZH-TW, and Privacy and Terms as text until the legal pages exist. The mockup's "[logo] [App name]", 简 and 繁, and links are dropped.
Main's code field: no placeholder and no length limit, at the control's height.
Progress on the clicked control: a spinner on Continue, Send code and Sign in, with the label kept. Main's busy SubmitButton (#974) already draws it.
Comfortable Density at every width (#395's spec): 44 px controls, 16 px text.
No connection and the fallbacks are drawn on step 1 only; steps 2 and 3 show them in the same place.
The paused alert is main's, word for word; main shows it only after Continue, never on arriving from Start again.
#407's decisions of 11 Oct are newer than PRs #421 and #423 and win: the lock counts across challenges and holds at every step, the alert's number is the Insurer's own, and the last resend shows no form error.

main → spec No email on file: the body reads "Your policy has no email on file. Call the call centre to report your claim." Main says "no phone number or email".
main → spec Step 2, email only: the heading "We'll email you a code", one Email card with no radio, and the help "This is the email on your policy. Not yours any more? Call the call centre." Main has "Where should we send your code?", radio cards with SMS first, and "This is the only contact…" only with one contact.
main → spec Step 3: the back link "Back", the heading "Check your email", and "We sent a 6-digit code to …". Main has "Send it somewhere else", "Check your messages" and "… by email to …".
spec #395 → comment The switcher on the code step: it shows on every step. The spec says "hidden on the code step"; main already shows it.
ticket #429 → comment Controls on a phone: #429's 44 px Input and Button below 48rem cover these pages' fields and buttons too.
ticket #407 → comment Step 2's paused alert: a Send code that answers 429 IDENTITY_POLICY_LOCKED shows "Sign-in paused for this policy" above step 2's form, with the countdown and the number. Main's step 2 would show "Too many attempts…".
ticket #407 Decided there, built nowhere yet: the lock across challenges and at every step; the Insurer's own number in the paused alert (main shows the platform's); no form error beside the last resend (PR #423 shows one).
main → spec Comfortable from 48rem up: the Client pages keep 44 px controls and 16 px text at every width. Main's are 32 px with 14 px text.

The language switcher shows on every step, the code step included. (12 Oct 2026)
Signed in on a phone, the switcher lives only in the burger menu and the header pill goes; signed-out steps keep the pill. (12 Oct 2026)
A locked Policy shows the same paused alert on step 2 when Send code meets the lock, above the form, with Send code left on. (12 Oct 2026)

From client-sign-in.html and main's ui/Claim, ClientHeader, ClientFooter; #395, #407 (PRs #421, #423), #502, #628