Account & Security

Everything about your account — profile, password, two-factor authentication, active sessions, connected accounts, and account deletion — is managed from Account in your dashboard, under Profile and Security.

Profile

• Display name — shown to teammates and support.
• Avatar — upload a PNG, JPEG, or WebP image up to 2 MB.
• Email — click Change next to your email, enter the new address, and confirm it with the 6-digit code sent to that inbox. Your sign-in email does not change until the code is confirmed, and you can cancel a pending change at any time.

Security

Password

Set or change your password from the Security page. If you already have a password, you must enter it to set a new one.

Two-factor authentication (2FA)

Turning on 2FA requires an authenticator app (Google Authenticator, 1Password, Authy, etc.):

1. Click Turn it on and scan the QR code with your authenticator app (or enter the secret manually).
2. Enter the 6-digit code your app shows to confirm setup.
3. Save the backup codes shown — each can be used once if you lose access to your authenticator. They are shown only once.

Disabling 2FA requires confirming your password first.

Sessions

The Active sessions card lists every device currently signed in. Revoke any session you don't recognize individually, or use Sign out all other devices to end every session except the one you're using right now.

Connected accounts

Link or unlink Google or Discord for sign-in. Unlinking requires confirming your password first.

Deleting your account

From Security → Danger zone → Delete account, you can permanently delete your account. Before you can proceed:

• Transfer ownership of any team you own that has other members.
• Cancel any active subscription.

Once confirmed (by typing your account email), deletion is queued and runs in the background: your servers and subscriptions are canceled and removed, your team memberships end, and your account is deleted from our identity provider. This cannot be undone.

Sensitive actions require a fresh confirmation

Changing your email, disabling 2FA, unlinking a connected account, signing out all other devices, and deleting your account all require you to re-enter your password (or a 2FA code) immediately before the action — even if you're already signed in. This protects your account if your session is ever used by someone else, such as on a shared or unlocked device.