git.cafeDocs
Your account
Documentation/Your account

Password recovery

If you lose your password, /auth/recover can email you a link to set a new one. Email recovery is unavailable while Require a passkey is enabled: use your passkey to sign in. This setting is a passkey-only policy: password sign-in is rejected rather than followed by a second passkey step. Recovery also requires the deployment's mail service to be configured.

Enter the email address on your account and press Send recovery link. The page always reports that a link is on its way if an account exists; it does not reveal whether one does or whether passkey requirements prevent recovery. The link expires in 15 minutes. A new request replaces the earlier link, except that repeat requests within 60 seconds leave the current link in place.

Setting the new password

The emailed link opens /auth/recover-password with the token filled in. Enter a new password of at least 12 characters twice; the button stays disabled until both match. Completing recovery:

  • sets the new password,
  • signs out every existing session,
  • revokes every passkey and account token grant, including CLI logins and authentication grants bound to SSH keys.

You are then asked to sign in again with the new password. A used, expired or tampered link is refused; request a new one.

Recovering passkey-only access

Before you lose access, enable Require a passkey, then open Settings → Account and generate recovery codes. Confirm the action with a recent password or passkey prompt. Save all eight codes offline: each contains 128 random bits and the plaintext is shown only in that response. Generating a replacement set immediately invalidates the old set. Changing the passkey requirement also changes the authentication epoch and invalidates the set; generate new codes after enabling it. If replacement fails after being requested, the outcome may be uncertain: do not use the displayed old set, and generate a fresh set.

If every passkey is unavailable, open /auth/recover, expand Use a recovery code, and enter your account email, one saved code, and a new password. A valid code consumes the entire remaining set, disables passkey-only sign-in, changes the password, and revokes all existing sessions, passkeys, token grants, and pending account-recovery proofs. Sign in again with the new password, then add new passkeys and generate a new recovery-code set. Invalid, old, and already-used codes all produce the same failure.

Read as MarkdownGitCafe documentation
Documentation