Everything covered here lives on the Account and security page (/auth/idp/account), reachable from the sidebar. It is where you enroll a second factor, view and regenerate your recovery codes, remove a factor, review accounts linked to your login, and see which sessions are currently signed in.
Setting up an authenticator app (TOTP)
Sign-in uses email and password by default. To require a second factor, click Add factor in the Second factors section and choose an authenticator app. The confirmation page that follows shows the setup information for your authenticator app exactly once, with a clear warning that it will not be shown again — write it down or copy it into your password manager immediately. Scan it with an authenticator app such as Google Authenticator, Microsoft Authenticator, or 1Password, or enter the secret manually if your app does not support scanning.
Enter the current 6-digit code from the app to confirm. A wrong code returns you to the factor list to start over — nothing is enrolled until the code is confirmed. Once confirmed, every future sign-in asks for a code from the app after your password is accepted.
Setting up your first second factor also generates a set of recovery codes for you at the same time. Store them alongside the authenticator setup — see the next section.
Recovery codes
Recovery codes let you sign in when you cannot reach your authenticator app: enter one instead of a TOTP code on the sign-in code-entry step. Each code works once. The Second factors section shows how many codes you have left ("N codes remaining"), so you can see when it is time to generate a fresh set.
To generate a new set, click Generate new recovery codes. The new codes are shown once, on that response only, with the same "shown only once" warning as the authenticator setup — copy or write them down before leaving the page. Generating a new set replaces the old one: any codes from a previous set stop working immediately.
Treat recovery codes like a password: anyone who has one can use it to get past your second factor. Store them in a password manager or another secure location, not in a plain text file next to your project.
If you lose your authenticator app
If you still have unused recovery codes, use one on the sign-in code-entry step to get in, then go to Account and security, remove the old authenticator factor, and set up a new one on your new device.
If you have also run out of recovery codes, you cannot complete a second factor challenge on your own, since both paths into the account console require getting past sign-in first. Contact support@codecharter.tools from the email address on your account.
Removing a factor
Click Remove next to a factor in the Second factors list, then confirm. This immediately stops that factor from being accepted at sign-in.
The Remove button is not shown for a factor if removing it would leave you unable to sign in to your account at all. If you reach that state anyway (for example from a page you had open before removing something else), the removal is refused with an explanation instead of going through.
Linked accounts
If your account is linked to an external account you can use to sign in, it appears under Linked accounts. Click Unlink to remove the connection; a confirmation dialog explains that you will no longer be able to sign in with it. As with factor removal, unlinking is blocked if it would leave you with no way to sign in to your account.
Active sessions
The Active sessions section lists every browser and device currently signed in to your account, each with the browser identifier it presented and when it was last active. The session you are viewing the page from is marked This device.
Click End session next to any entry and confirm to sign that device out immediately. Do this whenever you signed in on a machine you no longer control, or notice a session you do not recognize — see Reading the audit log to check when and from where a sign-in happened. Changing your password also signs out every other session automatically; see Login and Logout.
Not the same as authorized devices
Active sessions here and Authorized devices under /api-keys both list things you signed in from, but they cover different things:
- An active session is a browser signed in to the portal with your email and password (plus a second factor, if you enrolled one). Ending one signs that browser out of the portal.
- An authorized device is a developer machine that ran
codecharter login. It holds a token that can only renew a CLI license for your account — it cannot sign in to the portal itself and does not appear in Active sessions. See Authorized devices.
If you are trying to disconnect a CLI machine rather than a browser, use Authorized devices, not Active sessions.