# Secure your account Source: https://docs.graphops.xyz/platform/account-and-security Protect your GraphOps account and keep a working way to sign in when you replace a device or disconnect a provider. Your account holds your personal sign-in methods and sessions; organization roles control what you can do in each team. _You sign in with a primary method, add a second factor so a password or passkey alone is not enough, and get a session on each browser or device. GraphOps prevents removal of your last usable sign-in method._ - Sign in with: Password, Passkey, Google or GitHub. - Second factor: Authenticator app, Security key. - Sessions: One per browser or device, End any of them from Account. - Keep another working sign-in method before removing one. ## Create an account or sign in [Create account](https://platform.graphops.xyz/auth/register) [Sign in](https://platform.graphops.xyz/auth/start?mode=login) Choose email or an available Google or GitHub sign-in option. Provider options depend on which methods are enabled. Complete any requested profile details and email verification before continuing to your organization. Use a permanent email address, such as your work email. GraphOps does not create accounts with temporary or disposable email addresses. If your Google or GitHub email is one, enter a permanent address on the profile step. If GraphOps finds an existing account for your email, follow the sign-in and connection prompts to prove that account belongs to you. This includes signing in with Google or GitHub for the first time with the email of an account you created with a password. Review the account shown before confirming a connection. Each mailbox can have one GraphOps account. Gmail addresses that differ only in dots, a `+` tag, or `googlemail.com` reach the same mailbox, so they count as the same address. A `+` tag also counts as the same address on Outlook, Hotmail, Live, MSN, iCloud, Fastmail, and Proton. For other email domains, each exact address is its own mailbox. If you are accepting a team invitation, use the account with the invited email address. If GraphOps says access to your account is disabled, signing in again does not restore it. Contact [support](./support-and-status) if you think your access should be active. ### Find your verification email The GraphOps verification email contains a verification code and a link. Enter the code on the page where you started, or open the link. Both expire at the time shown in the email. Check your inbox and spam or junk folder for the GraphOps verification email. If it was marked as spam, mark it as **Not spam**. Choose **Haven’t received it?** on the verification page to resend, then use the code or link from the latest email. When you start with Google or GitHub, finish sign-in in the browser where you began. A verification link opened elsewhere can verify the email, but you still need the original browser to continue that sign-in attempt. If the attempt has expired, start sign-in again. ## Open your account settings Choose **Account** from the sidebar or your account menu. You can manage your personal sign-in methods even before joining an organization. Account has three sections: **Sign-in methods**, **Two-factor authentication** and **Sessions**. [Account](https://platform.graphops.xyz/account) Available methods show whether they are configured or disabled by policy. Complete the sign-in check when prompted before changing credentials, connecting a provider, or removing a method. After returning to **Account**, check that the method's status or entry reflects your change. ## Set a password or add a passkey Under **Sign-in methods**: * Choose **Set up password** or **Change password** below **Password**, then follow the sign-in and password prompts. * Choose **Add passkey** and follow your browser or device's enrollment prompts. After returning, check that the named passkey is ready before relying on it. You can sign in with a passkey instead of your password. A passkey replaces your password only: when you have set up [two-factor authentication](#add-two-factor-authentication), GraphOps also asks for your second factor after a passkey sign-in. If setup was interrupted and **Check setup** appears, use it to confirm the previous result before starting another setup. If you cannot sign in with your password, use password recovery from the sign-in page. ## Connect Google or GitHub Connecting a provider lets you use it to sign in to the same GraphOps account. 1. In **Account**, find **Connected accounts**. 2. Choose the available **Connect Google** or **Connect GitHub** action. 3. Sign in to the intended provider account, complete the requested GraphOps account verification, and confirm the connection. 4. Check that the provider and account appear in **Connected accounts**. A provider with a different email can be connected to your existing account. Connecting it does not change your GraphOps account email or move your organization memberships. ### Disconnect a provider Keep another working sign-in method before disconnecting a provider. GraphOps requires proof using another permitted method and prevents removal of your last usable sign-in method. An authenticator app or a security key used only as a second factor does not replace a primary sign-in method. Open the connected account's action menu, choose **Disconnect**, and complete the verification and confirmation. Check that the connection disappears when you return. Disconnecting a provider does not end existing GraphOps sessions; use the session controls below when you also want to end access from a device. ## Add two-factor authentication Use **Two-factor authentication** to add another check to your sign-in: * Choose **Set up authenticator** to enroll an authenticator app and confirm its code. Once enrolled, use **Manage authenticator** to manage it. * Choose **Add security key** to enroll a security key, or **Manage security keys** to manage existing keys. Follow the hosted sign-in prompts and check the configured status when you return to **Two-factor authentication**. Adding or removing an authenticator app shows there as soon as you return. If GraphOps could not confirm the change, open **Two-factor authentication** again to check its status before changing it again. Two-factor authentication requires a second factor every time you sign in with your password or a passkey. After a passkey sign-in, use your authenticator app: a security key cannot be checked in the same sign-in as a passkey, so sign in with your password or a connected provider when a security key is your only second factor. Your sign-in policy determines which methods are available and whether a second factor is required; it can prevent removal of a required factor. ## Remove a passkey Before removing a passkey, make sure you can sign in with a password or a connected provider. Passkey removal requires fresh proof with one of those methods; another passkey alone is not sufficient. In **Passkeys**, open the named key's action menu, choose **Remove passkey**, and complete the verification and confirmation. Check that the key disappears from the list. Enroll a replacement before removing a key you still depend on. ## Stay signed in After you sign in, GraphOps remembers your sign-in on that browser. When your platform session needs renewing, choosing **Sign in** continues without asking for your credentials again until that sign-in expires. Signing out, or ending the session below, ends it on that browser. Changing your sign-in methods or two-factor authentication still asks you to confirm it's you. ## Sign in again for sensitive changes Changes only a person can make need a recent sign-in. They include creating, editing, and rotating API keys, managing service accounts, changing your plan or payments, and changing members and invitations; the **Person only** permissions in [Team and roles](/platform/team-and-roles#roles) list them all. If you have not signed in in the last 12 hours, GraphOps explains that the change needs a recent sign-in. Choose **Sign in** to sign in again and return to the same page, or cancel to stay where you are without making the change. You come back with everything you had entered. This sign-in always asks for your credentials, even when your browser is still signed in. The GraphOps CLI tells you when a command needs a recent sign-in: run `graphops auth login`, then run the command again. A request to the GraphOps platform API is refused with `403` and the code [`reauthentication_required`](/platform/errors/account#reauthentication_required). ## End a device session Review **Sessions** for devices you no longer use or do not recognize. Compare the device, IP address, and update time before selecting a session. The IP address is recorded when that session starts. It can be shared by people using the same network or VPN, and it does not change when you view the list from another connection. Older sessions can retain an address recorded before an IP collection correction. Completing a sign-in check from **Account** signs you in with a new session on that browser and ends the session it replaced, so repeated checks do not add sessions. To end a session, open its action menu, choose **End session**, and confirm. Check that the session is removed. Ending your current session signs you out, so sign in again to continue. Sessions labeled **CLI** belong to the GraphOps CLI. Ending one signs the CLI out, and it must sign in again; see [sign in to the CLI](/platform/cli-sign-in#end-a-cli-session). Ending a device session also ends existing support account access across your signed-in tabs. Reload the platform from a session you kept to reconnect support. If a removal was interrupted and **Check removal** appears, use it to confirm the outcome before attempting another removal. If the result remains unresolved, contact [support](./support-and-status) with the action, approximate time, and displayed error. Never send passwords, verification codes, or session credentials. ## Next steps * [Team and roles](/platform/team-and-roles): Invite teammates and choose their roles. * [API keys](/platform/api-keys): Protect the keys your applications use. * [Support and status](/platform/support-and-status): Get help with an account or access issue.