Account & two-factor

Your account settings are split across the pages in the Account section of the sidebar: Profile (your username, mailbox discoverability and Log out), Security (two-factor authentication and your password), Notifications (which mail is also emailed to you, and the devices notifications are sent to), and Delegation.

Two-factor authentication

Two-factor authentication (2FA) adds a second step to sign-in. It is optional for ordinary users and mandatory for Admin and Moderator accounts.

You can choose:

• Authenticator app (TOTP) — scan a QR code with an app like your phone's authenticator, then enter the 6-digit code it generates. This is the most reliable method.
• Emailed codes — we email a one-time code at sign-in.

Once 2FA is on, signing in asks for your password and then the second-factor code.

Sessions

Signing in issues a short-lived token that is refreshed silently in the background, so you stay signed in without re-entering your password. Signing out revokes the refresh token on the server.

Delegation

You can delegate view or manage access to your own saved accounts (IMAP, CalDAV, VPN) and your billing view to another user or team, from Account → Delegation. Delegates act through a separate set of shared endpoints and only get what you granted.