Sign-in & Lock Screen

Besides your email and password, Cloud OS offers three more ways to get in and out quickly: passkeys, approving a sign-in from a device where you’re already signed in, and a lock screen that pauses your session without signing you out.

All three are available on every plan.

Passkeys

A passkey signs you in with Face ID, Touch ID, Windows Hello, your phone, or a hardware security key such as a YubiKey. You don’t type a password, and a passkey can’t be phished: it only works on your node’s own address.

Add a passkey

Sign in as usual and open Profile → Security, or choose Passkeys in the account menu (your photo at the right of the menu bar).
In Passkeys, choose Add passkey and follow your browser’s prompt.
Give it a name you’ll recognise later (“MacBook”, “YubiKey”). You can rename or remove a passkey at any time, and the list shows when each one was last used.

On the login screen, choose Sign in with a passkey. You don’t need to type your email — your device offers the passkeys it has for this node.

Two-factor authentication. If you’ve turned on 2FA (TOTP), a passkey that checks it’s really you (fingerprint, face or device PIN) counts as both factors, so you won’t be asked for a code. A security key without a PIN or fingerprint only proves you have the key, so you’ll still be asked for your 6-digit code.

When passkeys aren’t offered

Browsers only allow passkeys on secure pages. Passkeys are hidden when you open Cloud OS:

over plain http:// from anything other than localhost, or
by IP address (for example http://192.168.1.20:8080).

Open the node through its HTTPS domain instead (see Domains & SSL). Passkeys belong to the address you registered them on. If you reach your node through several subdomains of one domain, see Passkey domain to make one passkey work on all of them.

If you’re already signed in somewhere else, such as on your phone, you can use that device to let a new one in:

On the new device’s login screen, choose Approve on another device and enter your email.
The screen shows a two-digit code.
On the device where you’re signed in, a Sign-in request prompt appears on the desktop with the new device’s type and location (pending requests are also listed at the top of Profile). Type the code from the other screen and approve.
The new device signs in automatically.

The request expires after 2 minutes. The notification does not include the code. You have to read it from the screen that’s asking. That way nobody can get you to approve their sign-in just by sending you requests. If you type the wrong code, the request is denied and the other device has to start again. Every approval and denial is recorded in the audit log and on the timeline, for example “Sign-in approved from iPhone”.

If you have the mobile app paired (see Mobile Pairing), you’ll also get a push notification.

Lock screen

Locking keeps your session, open windows and work where they are, but nobody can use them until you unlock. Use it when you step away from a shared computer.

To lock, click the lock button in the menu bar, or press Ctrl/⌘+K and choose Lock screen. The desktop is hidden completely while locked.

To unlock, enter your password or use a passkey.
While the session is locked, nothing can use it, including background requests from open tabs. Signing out still works.
Locking lasts until you unlock. Reloading the page or waiting for the session to refresh doesn’t unlock it.
Wrong passwords on the lock screen count toward the same limit as the login form: after 5 attempts in 15 minutes, you have to wait.

The login and lock screens show some basic facts about the node: its name, how long it has been running, how many apps are installed and the Cloud OS version. No account information is shown before you sign in.

Scan a QR code. Choose scan a QR code on the sign-in screen and scan it with the paired Quazzar mobile app.
Sign in with Quazzar Cloud. Shown when the node is linked to the Control Panel. See Setup Wizard.

The sign-in screen remembers the last account used in this browser and shows its name and photo. Choose the not Alex? use another account link (with your first name) below the form to sign in as someone else. The screen works on phones, every field has a visible label, and Back returns from the two-factor step to the password.

Locked out of the only admin account? Reset its password from the server console with sudo quazzar-cli admin reset-password — see Forgot the admin password?.

Profile

Open Profile from the account menu (your photo at the right of the menu bar) or with Ctrl/⌘+K. It has three tabs:

Personal Info: your name, email and plan.
Security: passkeys, two-factor authentication, change password, active sessions (revoke any of them) and a link to API keys.
Notifications: which notifications you receive.

Profile photo

Use Upload photo (or Change photo) at the top of Profile. PNG, JPEG or WebP, up to 2 MB. It’s cropped to a square automatically, and photo metadata such as GPS location is removed. Without a photo, your Gravatar is used. The photo appears in the menu bar and on the sign-in and lock screens.

Appearance follows you

Your accent colour, light/dark theme, motion level, interface sounds, default mode (Server, Personal or Cluster) and which blocks are shown on Overview and Home are saved to your account, so they follow you to every device. See Dashboard Customization.

For the endpoints behind these features, see the Cloud OS API reference.