Your account
Account settings are separate from workspace settings: your profile and credentials belong to you and follow you into every workspace you join.
Profile and email
Account → Profile edits your name and avatar. Changing your email address sends a confirmation code to the new address — the change only lands once you enter it, so a typo can't lock you out.
Password
Security changes your password; you'll be asked for the current one.
An account without a password, such as one that signs in with Google or GitHub, sees Set a password there instead. It opens the reset flow, and the emailed code sets your first password. Saving it signs you out on every device.
If you've forgotten your password, use the reset link on the sign-in page — it emails an 8-digit code that lasts 15 minutes. Asking again resends the same code.
After 10 wrong passwords in 15 minutes, signing in with a password pauses for that address — 15 minutes at first, longer if it keeps happening. Codes work the same way: after 10 wrong ones in an hour, that address can't use codes for an hour, however many new codes are sent. The message is the same whether or not the address has an account. Google and GitHub sign-in are not affected, and resetting your password ends the pause. If you can't wait, support can lift the pause once they've confirmed it's you.
Passkeys
A passkey lets you sign in with your fingerprint, your face or your device's PIN instead of typing a password. Your phone or computer keeps the key and checks that it's you; Sahabti never sees your fingerprint, your face or your PIN, and there is nothing to steal from us that would let someone sign in as you. Passkeys stored in a password manager (Apple Passwords, Google Password Manager, 1Password and others) sync between your devices and are marked Synced.
Security → Passkeys → Add a passkey: give it a name you'll recognise (the device or the password manager that will hold it), then confirm with your fingerprint, face or PIN when the browser asks. The list shows when each passkey was added and last used. Rename one with the pencil, remove one with the bin. Adding or removing a passkey needs a sign-in from the last 15 minutes: the page asks you to confirm it's you first.
To sign in with it, choose Sign in with a passkey on the sign-in page, or pick it from the suggestions under the email field.
A passkey is two-step verification on its own: your device holds the key, and it checks it's you before using it. So once you have a passkey, signing in with your password, Google, GitHub or an emailed code also asks for the passkey — or for the authenticator app's code, if you have both. Adding your first passkey signs out every other device. Workspaces that require two-step verification accept a passkey or the authenticator app.
Lost the device that held your only passkey? Contact support from the address on your account. Once support has confirmed it's you, they can remove your passkeys: every device is signed out and you get an email. Sign in with your password, Google or GitHub, then add a passkey again.
Two-step verification
Security → Two-step verification adds a code from an authenticator app (Google Authenticator, 1Password, Authy and others) to every sign-in, so a stolen password is not enough on its own.
- Select Turn on and confirm your password.
- Scan the QR code with the app, or type the key into it, then enter the 6-digit code it shows.
- Save the 10 backup codes somewhere safe, then choose I've saved them: while the codes are on screen, that is the only way to close the window. Each one signs you in once if you lose your phone, and they are not shown again — New backup codes replaces the whole set.
Turning it on signs out every other device. From then on every sign-in asks for a code — with a password, with Google or GitHub, and with an emailed code alike. Turn off asks for your password again.
An account that signs in only with Google or GitHub has no password to confirm with. Instead, turning two-step verification on or off, or replacing backup codes, needs a sign-in from the last 15 minutes — after that, the page asks you to sign in again with Google or GitHub and brings you back.
Lost your phone and your backup codes? Contact support from the address on your account. Once support has confirmed it's you, they can turn two-step verification off: every device is signed out, you get an email with the support reference, and you set it up again under Security → Two-step verification after signing in with your password. The reset also shows in your Activity.
A workspace can require two-step verification of every member (Workspaces & roles); an authenticator app or a passkey both count. If one of yours does and you have neither, opening it shows a page that links here; your other workspaces aren't affected, and the workspace opens as soon as you've set one up. Removing your last one closes those workspaces to you, and to your API tokens and connected apps, until you set one up again.
Sahabti staff accounts must use two-step verification with an authenticator app: the admin console and every staff tool stay closed until it is set up. A passkey doesn't replace it there.
Sessions
Sessions lists every device signed in to your account, with its last activity. Revoke any of them individually, or sign out everywhere at once if you think a device is compromised.
The same page lists Apps with access: AI assistants and other apps you signed in to with this account over MCP. Each acts as you, so each is marked Unverified app and shown with the address it sends sign-ins to and the one workspace it acts in. An app approved before you chose a workspace for it is marked as acting in every workspace you belong to, with the date it stops working, 16 November 2026. Reconnect ends that access, and when you connect it again from the app it asks you to choose one workspace. Revoke access stops its tokens at once; the app has to ask you again before it can act for you.
Activity
Activity is your account's audit feed: sign-ins, two-step verification turned on, off or reset by support, and any support session a Sahabti operator opened on your account. Support sessions are deliberately visible here — they can't appear in the device list, so this feed is how you see one happened.
Connected accounts
Integrations lists the GitHub accounts you've connected and which workspaces they grant access to. Disconnecting one here stops the web apps that were deploying through it — they show as disconnected until the account is reconnected. See Web apps.
Next steps
- Workspaces & roles — the settings that belong to a team rather than to you
- Web apps — what a connected GitHub account is for