# Account settings

Open **Settings → Account** to manage your sign-in methods and signed-in devices.
Sign in before changing these settings.

## Email

After signing up with a password, check your email for a verification message.
Verify your address before continuing to a repository.
If email verification delivery is not configured or is invalid, signup fails and
no account is created. Contact the instance operator rather than retrying with a
different address.
If the browser cannot retain the session, allow cookies and sign in to the account
already created; do not create another account. Opening a verification link while
signed out verifies the address, then offers sign-in to continue.

Your address is shown with a **Verified** or **Unverified** badge. While it is
unverified you cannot create or import repositories; use **Send verification
message** to have a fresh link emailed, then open it.

Use **Change email** to request a replacement address. Confirm with your password
or a passkey if prompted, then open the verification link sent to the new address.
Your current address remains active until that link is verified. Requesting a
different replacement invalidates the previous replacement's link. Changing or
recovering your password cancels pending email changes.

## Password

Enter your current password, a new one of at least 12 characters, and the same
new password again. The button stays disabled until the confirmation matches
and the new password is long enough. A successful change signs out every other
session. A wrong current password is reported as "The current password is
incorrect."

## Passkeys

Passkeys sign you in without a password and confirm sensitive changes.

- **Add passkey** asks for a label, then runs your browser's passkey prompt.
  Up to 20 passkeys per account.
- Each passkey shows whether it is **Synced** (backed up across devices) or
  **Device-bound**, when it was added and last used. A **Counter anomaly**
  badge means the authenticator's signature counter went backwards; treat that
  passkey as suspect and delete it.
- Rename with the pencil, delete with the bin. You cannot delete your last
  passkey while passkey sign-in is required or your account has no password.
- **Passkey-only sign-in**: **Require a passkey** rejects password sign-in and
  disables email password recovery. The passkey button starts an independent
  sign-in; it is not a second step after a password. Turning the requirement on
  or off is confirmed with a passkey prompt and is offered once a passkey exists.

Failed password and recovery requests use generic credential responses. They do
not reveal whether an account exists or has passkey-only sign-in enabled.

### Recovery codes

After enabling **Require a passkey**, use **Generate recovery codes** to create
eight one-time codes for recovering a passkey-only account. This requires the
same recent confirmation as other sensitive credential changes, including an
MFA-satisfied session when passkeys are required. The codes are displayed once;
save them offline before leaving the page. Only their cryptographic hashes are
retained. Generating again invalidates every previous code. Changing the passkey
requirement starts a new authentication epoch and invalidates every saved code,
so generate a fresh set after enabling the requirement. If generation reports
an uncertain failure, assume the prior set may be invalid and generate again.
See [Password recovery](https://git.cafe/docs/account/password-recovery.md) for use and the authority that
recovery revokes.

If a passkey stops working after your GitCafe site's address changes, use another
sign-in method already enabled for your account or contact the instance operator.
Do not delete your only usable sign-in method while troubleshooting.

Adding, renaming and deleting passkeys, and changing the sign-in requirement,
require a recent confirmation (see below).

## Confirming it's you

Sensitive changes need a recent second confirmation. When one is needed the
screen opens a **Confirm it's you** dialog: use a passkey, or enter your
password. Success grants a short window (10 minutes for a password, 15 for a
passkey) during which the original action is retried automatically and further
changes do not ask again. Adding or removing a passkey ends the window early.
Sign-in and permission failures are shown normally and never open this dialog;
only an expired confirmation window can trigger it.

## Active sessions

Every signed-in session is listed with its short id, when it was created, when
it was last used and when it expires. **This device** marks the current
session; **Elevated** means the session has a recorded confirmation window,
which may already have expired. Sensitive actions check that window again. **Revoke**
signs out one other device; **Sign out everywhere else** signs out all of them
and reports how many were revoked.

## Close account

Account closure requires a recently confirmed human session and typing your
handle exactly. It is currently available only for empty, never-billed personal
namespaces. Transfer personal repositories, then wait for repository admissions,
imports, and transfers to finish. Deleting a repository does not unblock closure:
closure fails closed for every repository row, and deleted
repository tombstones still retain native storage because native retirement
absence cannot currently be validated. A Stripe customer or any subscription
record, including a canceled one, also remains a blocker; this release does not
offer a safe self-service way to clear that custody. Memberships also block
closure: ask an organization owner to remove you, and transfer ownership first
where you are the only owner. The screen reports blocker counts and links to
the relevant settings or documentation.

Closure signs out every device, revokes grants, passkeys, pending email proofs,
and recovery proofs, and archives the personal namespace. Your actor is tombstoned so historical
issues, comments and audit records keep their author identity. Repository and
other content is never physically deleted by account closure. Closure records a
validated durable event in the same transaction. Instance administrators can
inspect an exact receipt through the operator API.