Account & Security
Sign up, sign in, two-factor authentication, passkeys, profile, and language.
Everything about a customer's identity lives under Settings. This guide covers signing in and locking the account down.
Creating an account
Sign up
Customers register with email + password at /signup, or with a social login
(Google/GitHub) when those are configured.
Verify email
If email verification is enabled, a verification link is sent before the account is fully active.
Onboarding
A short flow collects a display name, optional avatar, and preferred language.
Signing in
The portal supports several sign-in methods, depending on what the operator has enabled:
| Method | Notes |
|---|---|
| Password | Standard email + password. |
| Magic link | Passwordless — a one-time link sent by email. |
| Passkeys | WebAuthn biometric/security-key login. |
| Social | Google / GitHub, when configured. |
Two-factor authentication (2FA)
Open Settings → Security
Find the Two-factor authentication section.
Scan the QR code
Use any authenticator app (1Password, Authy, Google Authenticator) to scan the code, then enter the 6-digit code to confirm.
Save your recovery codes
Store the backup codes somewhere safe — they're the way back in if you lose your device.
After enabling, sign-in prompts for a code at /two-factor.
Passkeys
Passkeys replace passwords with your device's biometrics or a hardware key. Under Settings → Security, choose Add passkey and follow the browser prompt. You can register multiple passkeys (laptop, phone, security key) and remove any of them later.
Profile
Under Settings → Profile, customers can update:
- Display name
- Avatar — uploaded to secure object storage via a presigned URL
- Language — see below
Language
The entire UI is localized. Change it in two places, which stay in sync:
- The language switcher in the top navigation (applies immediately)
- Settings → Profile → Language (also saved to the account)
The selected language is stored both in a cookie (so the current browser switches instantly) and on the account (so it follows the user across devices).
Danger zone
Settings → Danger holds irreversible actions such as account deletion. These require an explicit confirmation step.