For schedule viewers
Open your schedule without learning the whole system
Most people need only an invitation and a current browser. The guide takes you from the first link to the right event, then shows the few controls that may matter later.
What you need before you start
- An activation link, QR code or deliberately public schedule link
- A current browser on a phone or computer
- A passkey-capable device or password manager
- A way to contact the organiser if the event looks wrong
Work through the steps
- 01Open this step
Open the invitation
Use the activation link or QR code sent by an authorised organiser. Check that the event and controller are the ones you expect.
You are ready to continue when: The activation page identifies the expected event and published privacy information.
- 02
Review and confirm
Read the short processing explanation and its privacy and rights links before continuing.
You are ready to continue when: You understand why the account exists and where to ask a question or request deletion.
- 03
Create a passkey
Follow the prompt from your browser or password manager. Your device keeps the private credential; MP-Opt receives the public information needed to recognise it.
You are ready to continue when: The one-time invitation is used and your schedule opens.
- 04Open this step
Use the right view
Authenticated Masterplan views can contain names and assignments. Public schedule links contain only fields deliberately published for that audience.
You are ready to continue when: You can recognise whether you are signed in or using a public link.
- 05Open this step
Choose optional device features
Install the web app, offline schedule or notifications only if they are useful on this device.
You are ready to continue when: Only the device features you want are enabled.
- 06
Manage or remove access
Review sessions and passkeys from Account Security. Use Delete my data or contact the controller when you want an erasure request.
You are ready to continue when: Unexpected access is revoked or the accountable deletion workflow has started.
Two schedule audiences
The audience is fixed by the publication surface rather than selected field by field.
Public Schedule
Always public to anyone holding the intentionally published route or bearer link
Masterplan
Always restricted to authenticated people with an assigned event role
Passkey and session flow
The authenticator retains the private passkey; the Server stores a public credential and bounded session digest.
1
Challenge
Server issues a short-lived WebAuthn challenge
2
User presence
Authenticator signs for the exact origin
3
Verification
Server verifies public credential, origin and counter
4
Session
Protected cookie carries a bounded session token
5
Reauthenticate
Privileged actions request a fresh passkey assertion