Recover and protect your account

Your dashboard account is separate from integration tokens. An administrator invites you to an organization and environment; password recovery and MFA are managed per account.

Reset your password

On the sign-in screen, select Forgot your password? and enter your email. If SMTP is configured, the dashboard shows the same confirmation for known and unknown addresses. It does not reveal whether an account exists.

The link expires after 30 minutes and can only be used once. Open the form, choose a password of 12 to 256 characters, and confirm it. Completing the reset invalidates all previous sessions and links; sign in again. If the link is missing, expired, or already used, request another.

Resetting a password preserves MFA. Recovery email does not remove your second factor or its codes. Without SMTP configuration, recovery is unavailable; sign-in, invitations, and authenticated password changes remain available.

Enable MFA

In My account, check availability and status. You need your current password and a TOTP-compatible app.

1. Start setup with your password.
2. Scan the QR code or enter the manual key in your app.
3. Confirm with a current app code.
4. Save the ten recovery codes before closing.

The QR code and recovery codes appear during this process and are never revealed again. Recovery codes are single-use and recover the second factor; you still need your password. A previously used TOTP code is not accepted again: wait for the next one.

Once MFA is enabled, sign-in requires a password followed by an app or recovery code. The sign-in challenge expires after five minutes and allows up to five attempts; return to the password step to start another. Invitations to an existing account also respect MFA.

Change or remove factors

In My account, replacing recovery codes or disabling MFA requires your password and a current factor. Replacement invalidates all previous codes. Enabling, disabling, or replacing codes revokes other sessions and keeps a new session for the person who performed the operation.

If the response is lost when enabling MFA or replacing codes, reload the status: secrets are not shown again. You can sign in with the app and generate new codes after a fresh verification. Losing the app and all codes does not provide an automatic email bypass.

Installation configuration

The operator configures a dedicated, stable MFA_ENCRYPTION_KEY containing 32 bytes encoded as hexadecimal. It is not generated or rotated automatically at startup. Back up the key privately: changing it without migration can make factors inaccessible.

SMTP uses SMTP_HOST, SMTP_PORT, SMTP_FROM, SMTP_USER, SMTP_PASSWORD, and SMTP_TLS_MODE. STARTTLS is the default; direct TLS is another option. Plaintext is limited to local test transport. The same configuration is used for incident email.

Recovery deliveries use a durable queue with retries. Relay acceptance does not certify inbox receipt; a lost ACK can repeat the same link. See deployment, security, and validation status. Do not store SMTP passwords, encryption keys, or recovery links in Git or support responses.