Account settings
Open Settings → Account to manage your sign-in methods and signed-in devices. Sign in before changing these settings.
After signing up with a password, check your email for a verification message. Verify your address before continuing to a repository. If email verification delivery is not configured or is invalid, signup fails and no account is created. Contact the instance operator rather than retrying with a different address. If the browser cannot retain the session, allow cookies and sign in to the account already created; do not create another account. Opening a verification link while signed out verifies the address, then offers sign-in to continue.
Your address is shown with a Verified or Unverified badge. While it is unverified you cannot create or import repositories; use Send verification message to have a fresh link emailed, then open it.
Use Change email to request a replacement address. Confirm with your password or a passkey if prompted, then open the verification link sent to the new address. Your current address remains active until that link is verified. Requesting a different replacement invalidates the previous replacement's link. Changing or recovering your password cancels pending email changes.
Password
Enter your current password, a new one of at least 12 characters, and the same new password again. The button stays disabled until the confirmation matches and the new password is long enough. A successful change signs out every other session. A wrong current password is reported as "The current password is incorrect."
Passkeys
Passkeys sign you in without a password and confirm sensitive changes.
- Add passkey asks for a label, then runs your browser's passkey prompt. Up to 20 passkeys per account.
- Each passkey shows whether it is Synced (backed up across devices) or Device-bound, when it was added and last used. A Counter anomaly badge means the authenticator's signature counter went backwards; treat that passkey as suspect and delete it.
- Rename with the pencil, delete with the bin. You cannot delete your last passkey while passkey sign-in is required or your account has no password.
- Passkey-only sign-in: Require a passkey rejects password sign-in and disables email password recovery. The passkey button starts an independent sign-in; it is not a second step after a password. Turning the requirement on or off is confirmed with a passkey prompt and is offered once a passkey exists.
Failed password and recovery requests use generic credential responses. They do not reveal whether an account exists or has passkey-only sign-in enabled.
Recovery codes
After enabling Require a passkey, use Generate recovery codes to create eight one-time codes for recovering a passkey-only account. This requires the same recent confirmation as other sensitive credential changes, including an MFA-satisfied session when passkeys are required. The codes are displayed once; save them offline before leaving the page. Only their cryptographic hashes are retained. Generating again invalidates every previous code. Changing the passkey requirement starts a new authentication epoch and invalidates every saved code, so generate a fresh set after enabling the requirement. If generation reports an uncertain failure, assume the prior set may be invalid and generate again. See Password recovery for use and the authority that recovery revokes.
If a passkey stops working after your GitCafe site's address changes, use another sign-in method already enabled for your account or contact the instance operator. Do not delete your only usable sign-in method while troubleshooting.
Adding, renaming and deleting passkeys, and changing the sign-in requirement, require a recent confirmation (see below).
Confirming it's you
Sensitive changes need a recent second confirmation. When one is needed the screen opens a Confirm it's you dialog: use a passkey, or enter your password. Success grants a short window (10 minutes for a password, 15 for a passkey) during which the original action is retried automatically and further changes do not ask again. Adding or removing a passkey ends the window early. Sign-in and permission failures are shown normally and never open this dialog; only an expired confirmation window can trigger it.
Active sessions
Every signed-in session is listed with its short id, when it was created, when it was last used and when it expires. This device marks the current session; Elevated means the session has a recorded confirmation window, which may already have expired. Sensitive actions check that window again. Revoke signs out one other device; Sign out everywhere else signs out all of them and reports how many were revoked.
Close account
Account closure requires a recently confirmed human session and typing your handle exactly. It is currently available only for empty, never-billed personal namespaces. Transfer personal repositories, then wait for repository admissions, imports, and transfers to finish. Deleting a repository does not unblock closure: closure fails closed for every repository row, and deleted repository tombstones still retain native storage because native retirement absence cannot currently be validated. A Stripe customer or any subscription record, including a canceled one, also remains a blocker; this release does not offer a safe self-service way to clear that custody. Memberships also block closure: ask an organization owner to remove you, and transfer ownership first where you are the only owner. The screen reports blocker counts and links to the relevant settings or documentation.
Closure signs out every device, revokes grants, passkeys, pending email proofs, and recovery proofs, and archives the personal namespace. Your actor is tombstoned so historical issues, comments and audit records keep their author identity. Repository and other content is never physically deleted by account closure. Closure records a validated durable event in the same transaction. Instance administrators can inspect an exact receipt through the operator API.