Profile & Security
Open Profile from the avatar menu (top right) or the ⌘K palette. Everything here belongs to your account, so it is the same in every workspace.
Profile
Your display name and email address. Both are required. Your avatar comes from Gravatar for that email; without one the Control Center shows your initials.
Security
- Password: enter the current password and the new one (at least 8 characters) twice.
- Two-factor authentication: Enable 2FA shows a QR code, the secret and backup codes; scan it with an authenticator app and enter the 6-digit code to finish. Disable 2FA asks for your password.
- Security keys: register hardware keys and passkeys (YubiKey, Touch ID, Windows Hello), rename or delete them. Control Center sign-in asks for the authenticator-app code, so you need 2FA on before adding a key, and you have to delete your keys before you can turn 2FA off.
Notifications
Choose which events reach you by email and in the app (alerts, product updates, security, backups), and optionally send every notification to a webhook URL as JSON. Click Save preferences.
Sessions
Every signed-in browser or device with its IP address and sign-in time. Revoke signs one out; Sign out other sessions signs out everything except the device you are using.
Workspaces
Every workspace your account belongs to, with its mode, plan and your role in it. Switch opens another workspace (the same as the workspace switcher in the top bar). Leave removes you from a workspace after a confirmation; the only owner can’t leave, and you can’t leave your only workspace. See Workspaces.
When a workspace requires 2FA
If a workspace has Require 2FA for all members on (see Workspace Settings) and you have neither an authenticator app nor a security key, signing in takes you to Profile → Security with a banner. Set one up there; the rest of the workspace opens as soon as you have. You can still switch to or leave the workspace meanwhile.
API
| Method | Path | Description |
|---|---|---|
PUT | /api/auth/profile | {email, display_name} (both required) |
POST | /api/auth/password | {current_password, new_password} (alias of /api/auth/change-password) |
GET/PUT | /api/auth/notifications | Notification preferences (alias of /api/profile/notifications) |
GET | /api/auth/totp/status | Whether 2FA is on |
POST | /api/auth/totp/enable, /api/auth/totp/verify, /api/auth/totp/disable | Set up, confirm ({code}) and turn off ({password}) 2FA |
GET | /api/auth/webauthn/credentials | Your security keys |
POST | /api/auth/webauthn/register/begin, /finish | Register a key |
PATCH/DELETE | /api/auth/webauthn/credentials/{id} | Rename / delete a key |
GET | /api/auth/sessions | Active sessions; is_current marks the one you are using |
POST | /api/auth/sessions/revoke-others | Sign out every other session, keep this one ({revoked}) |
DELETE | /api/auth/sessions/{id} | Revoke a session |
GET | /api/workspaces | Your workspace memberships |
POST | /api/workspaces/{id}/leave | Leave a workspace |