Security: sessions, password change and sign-in lockout

These mechanisms protect your account if someone gets access to your password or device.

How it works

Active sessions. "Profile → Security → Active sessions" is the list of devices where you are signed in. You can end any session that isn't yours, and the other device is signed out immediately. Signing out of the app also ends the session on the server.

Password change and reset. When you change your password, or when the platform owner resets it, or a workshop owner resets it for an employee, sessions on all other devices are ended. Your current sign-in stays. The owner gives the employee a temporary password, and the employee will be signed out everywhere. After a change, you receive a "password changed" email. You can change your password no more than 5 times in 15 minutes.

"Protect the account". If someone else created an account with your email, click "Didn't sign up? Protect the account" in the confirmation email: all sign-ins to the account end (including API tokens), the password is reset, Telegram, notifications, webhooks and connected cloud drives are disconnected, and you get an email to set your own password. Confirming your email by itself does not end any sign-ins.

Sign-in lockout. After 5 wrong passwords within 15 minutes, sign-in is temporarily blocked for the IP address the password guesses came from. A timer is shown on the screen. Only the one who entered the passwords is blocked: other people's attempts don't stop the address owner from signing in from a different IP. The correct password still lets you in.

Integration tokens. An API token can't change the password or email, make a backup, invite people or delete the account: account management is available only through a regular sign-in. More details in API and webhooks.

FAQ

My sign-in was blocked, what should I do? Wait for the timer to run out or sign in from another connection. You can recover your password via "Forgot password?".

There's an unknown device in the list. End its session and change your password.

If something goes wrong

Changing the password returns a rate limit error: wait 15 minutes. You can't sign out on another device: end its session in the list; when you change your password, this happens automatically.