An emailed code is ClinyPal's way of confirming a sign-in that doesn't look like your last one. It isn't a sign of a problem, and after you check Remember this device you won't see it again on that computer for a month.
When a code is sent
A sign-in code is ClinyPal's check that the person who knows your password is also the person who can read your email. You're asked for one after a correct password when the sign-in doesn't look like your usual one: your first sign-in ever, a different computer, phone or browser from last time, a different network (home instead of the clinic, for example), or more than 6 days since you last signed in with a password. A sign-in that matches the last one goes straight through.
If you've set up an authenticator app, you're asked for its code instead and never get an emailed one. If you sign in with a passkey, or with Google or Microsoft, no emailed code is used either, because the code would go to the same inbox that sign-in already controls.
Enter the code
The page is headed Check your email. The email contains a 6-digit code that works for 5 minutes.
Type the 6 digits into Sign-in code
On a phone, the code often appears above the keyboard and can be tapped in.
Decide whether to check Remember this device for 30 days
Tick it on your own computer or phone, so you're not asked again there for a month. Leave it off on a shared device.
Select Verify
You're signed in and taken to the page you were heading for.
If the email doesn't arrive
Give it a minute and check the junk folder. If ClinyPal couldn't send the email at all, the page says We couldn't send your code. Select Resend code to try again. and the button works right away, with no countdown. Otherwise the page shows Resend in 60s counting down; when it reaches zero, Resend code sends a new one and the countdown starts again. The new code replaces the old one, so if both arrive, use the later email. If the whole sign-in has sat for too long the page tells you the code has expired and sends you back to sign in; enter your password again to get a fresh code.
If codes never arrive at all, your email address on your user may be wrong or the clinic's mail may be filtered. An administrator can check the address under Users & Practitioners.
Wrong codes lock the account
After the second wrong code you're warned: You have 1 more try before your account is temporarily locked. A third wrong code locks the account for an hour (longer if it has been locked before; see Your account is temporarily locked) and sends you back to the sign-in page. A code that has expired doesn't count as a wrong one; you're told it expired and can resend.