Account and security

Everything about your own account lives in the You group of the settings. Open it with Settings in the user menu (or in the sidebar). Settings save automatically; the page header shows Saved once a change is stored.

Page	What it's for
Profile	How others see you, your email address, and how you sign in
Preferences	Language, theme and time zone
Security	Password, two-factor authentication, passkeys, sessions and recent sign-ins
Notifications	Which updates reach you by email — see Notifications
API keys	Keys for scripts and other tools
Your data	Download your data, restore deleted workspaces, delete your account

Signing in

Sign in with your username or email and your password, with a passkey (Sign in with a passkey), or with one of the single sign-on buttons your instance offers.

• Remember me keeps you signed in on this device for 30 days. Without it, you're signed out after 12 hours.
• Forgot password? sends a reset link to your email address, if a password account exists for it. The link expires after 1 hour.
• If your account uses two-factor authentication, you enter the 6-digit code from your authenticator app after your password. A passkey sign-in skips this step: the passkey already verifies you on your device.
• If you see Verify your email first, your account is waiting for you to confirm your email address. Choose Resend email to get a new link.

Confirm your email address

On most instances, a new account has to confirm its email address before it can be used. After you choose Create account, sol2flow shows Check your email with the address you typed and sends you an email, "Confirm your email address for …".

1. Open the link in the email. It works once, for 24 hours.
2. If you opened it in the same browser you signed up in, you're signed in and taken straight to sol2flow. If you opened it somewhere else (another browser or your phone), you see "Your email address is confirmed. Sign in to continue." — sign in there, or go back to the first browser and choose Opened the link on another device? Continue.

Good to know:

• Nothing arrived? Check your spam folder, then choose Resend email. A new link makes older ones stop working. If you resend too often, you see "Too many attempts. Try again in … minutes."
• Typed the wrong address? Choose Wrong address? Sign up again. The unconfirmed account is deleted, so you can use the same username again.
• Sign-up says your address is already in use, but you never confirmed an account with it (someone else may have signed up with it)? Choose Send a confirmation email to this address. If the address belongs to an unconfirmed account, you get a link: it shows the account that would be removed, and after Remove it and continue you finish signing up with your address already confirmed.
• If your instance's administrators approve new accounts, the link page says Waiting for approval instead. You get an email when your account is ready.
• A sign-up that isn't confirmed within 7 days is deleted.
• If you were invited, or your administrators created your account, your address usually counts as confirmed already. If you sign in with single sign-on and your organization's provider doesn't confirm addresses, you get the same email once; after confirming, sign in with the provider again.

Profile

Settings → Profile shows what people in your workspaces see about you.

• Name saves as you type.
• Email is where sol2flow sends your emails — see Change your email address.
• Your Username can't be changed.
• Sign-in method shows how you sign in — with a password, or through your organization's identity provider.

Change your email address

On instances that require email verification, a new address only applies once you confirm it:

1. In Settings → Profile, type the new address under Email and choose Change email. (It isn't saved while you type.) If you signed in more than 10 minutes ago, Confirm it's you asks for your password first (or to sign in again with your provider).
2. The profile shows Pending: … with the new address. sol2flow sends a link to the new address, and a security email ("Your … email address is being changed") to your current one, naming the new address.
3. Open the link. Your address changes, and you see Email address changed.

Until you open the link, your current address keeps working for sign-in and emails. Under Pending, choose Resend email for a new link, or Cancel to keep your current address. If you didn't ask for the change, the security email tells you what to do: change your password and contact your administrator.

• Removing your address entirely doesn't need a link.
• If you see "This address isn't verified yet." (or, on the start page and on Notifications, "Your email address … isn't verified yet."), choose Send verification link and open the link we send you. Until your address is verified, invitations sent to it don't reach your notification bell and workspaces you could ask to join don't show up; once it is, invitations sent to it — also before you signed up — appear.
• On instances without email verification, the new address applies as soon as you save it (it's then unverified).
• Staff who change your address in the admin area apply it directly.

Profile photo

Your photo appears next to your name on cards, comments and in member lists — only to people who share a workspace with you.

1. Choose Upload photo (or Change photo).
2. Pick a PNG, JPEG, WebP or GIF image, up to 10 MB.
3. In Crop photo, drag to move the image and zoom to fit it in the circle. You can also use the arrow keys to move and plus / minus to zoom.
4. Choose Save photo.

Choose Remove to go back to your initials.

Preferences

Settings → Preferences:

• Language — the language of the app and of the emails you get.
• Theme — Dark or Light. Applies right away on this and your other devices.
• Time zone — dates and times across sol2flow are shown in it. The default, Automatic, follows the browser you're using. You can also pick a fixed time zone from the list (search by name); choose Use this browser's time zone to go back to Automatic. Your time zone is also used for time entries you type in, as the default for timesheet exports, and in emails to you. Due dates are calendar days and don't shift with the time zone.

Password

If you sign in with a password, you can change it in Settings → Security:

1. Choose Change password.
2. Enter your Current password and a New password (at least 8 characters).
3. Save.

If you sign in through single sign-on, your password is managed by your identity provider instead.

Two-factor authentication

Two-factor authentication adds a second step to signing in with a password: a 6-digit code from an authenticator app on your phone, such as 1Password, Google Authenticator or Microsoft Authenticator.

The code is only asked when you sign in with your password. Signing in with a passkey doesn't ask for it, even when two-factor authentication is on, because a passkey already verifies you on your device with your fingerprint, face or PIN.

To turn it on:

1. Open Settings → Security and choose Turn on two-factor authentication.
2. Scan the QR code with your authenticator app. If you can't scan it, enter the key shown below it instead.
3. Enter the 6-digit code the app shows and choose Turn on.
4. sol2flow shows 10 Recovery codes. Copy or Download them and keep them somewhere safe, like a password manager, then choose I've saved them.

warning

Recovery codes are shown only once. If you lose your phone, a recovery code is the only way to sign in. Each code works once.

When signing in, choose Use a recovery code instead if you don't have your phone. sol2flow warns you when you're running low on codes.

• New recovery codes creates a fresh set; your old codes stop working. You need a code from your authenticator app.
• Turn off removes the second step. You need your password and a code (or a recovery code).

If you sign in through single sign-on, two-factor authentication is handled by your organization's login instead.

If you've lost both your phone and your recovery codes, contact your instance's administrators — they can reset two-factor authentication for you.

Passkeys

A passkey lets you sign in with your fingerprint, face or device PIN instead of a password. Passkeys can't be phished. A passkey sign-in doesn't ask for your two-factor code, even when two-factor authentication is on: the passkey already verifies you on your device — it's on a device you have, and it unlocks with your fingerprint, face or PIN. Your device must be able to verify you this way; a security key without a PIN asks you to set one.

To add one:

1. Open Settings → Security.
2. Choose Add a passkey and follow your browser's or device's prompts.

The list shows each passkey with its name, when it was added and last used, and whether it's Synced across your devices. You can rename a passkey, or Remove passkey when you no longer use a device.

To sign in with a passkey, choose Sign in with a passkey on the sign-in page; many browsers also offer your passkey directly in the username field.

Confirm it's you

Some sensitive changes — turning on two-factor authentication, creating new recovery codes, adding or removing passkeys, creating API keys, signing out other devices, and deleting your account or a workspace — need a recent sign-in. If you signed in more than 10 minutes ago, a Confirm it's you dialog asks for your password first (or asks you to sign in again with your identity provider). You won't be asked again for the next 10 minutes.

sol2flow emails you whenever your password, two-factor authentication or passkeys change, so you notice if it wasn't you.

Sessions and devices

Settings → Security → Sessions lists the browsers and devices signed in to your account, with the device, when it signed in and when it was last active. Show IP addresses reveals where they connected from.

• Sign out a single device you don't recognise.
• Sign out all other devices signs out everywhere except the device you're using.

Below it, Recent sign-ins lists the last 10 devices and places your account signed in from — also those you've since signed out of — with the approximate location (when your instance knows it), the last and first sign-in, and how often.

Alerts about unusual sign-ins

sol2flow remembers the devices (browser and operating system, such as "Chrome · macOS") and places your account signs in from. When a sign-in looks new, you get an alert:

Alert	When
New sign-in to your account	from a browser or operating system you haven't signed in with before
Sign-in from a new location	from a country you haven't signed in from before
Sign-in from a new network	from a network you haven't used before, when your instance doesn't know locations
Urgent: unusual sign-in	from another country shortly after a sign-in elsewhere — farther than anyone can travel in that time

Your very first sign-in, and signing in again from a device and place you've used before, don't alert you. You get at most 5 alerts an hour.

Each alert appears in your notification bell. Open it to see the device, the approximate location, the IP address (partly hidden, like 203.0.x.x) and the time. You also get it by email while Settings → Notifications → Alerts about unusual sign-ins is on — it is on by default, and works even when your instance doesn't send other notification emails. The email never contains a link that changes anything.

• It was you (a new laptop, a trip, a VPN): you don't need to do anything. Next time, that device and place are known.
• It wasn't you: choose Not me, secure my account in the email, or Review security in the notification. In Settings → Security, choose Sign out all other devices, change your password and turn on two-factor authentication or add a passkey. Then tell your administrators.

The location comes from the IP address and is approximate: a VPN or a mobile network can make it look like you're somewhere else. Whether you see locations at all depends on your instance.

API keys

API keys let scripts and other tools use sol2flow on your behalf through the REST API. Open Settings → API keys (also in the user menu).

1. Choose Create API key.
2. Give it a Name so you recognise it later, choose when it Expires after (30 days, 90 days, 1 year or Never), and its Access: Full access or Read only.
3. Choose Create key and copy the key. It's shown only once.

A key can do exactly what you can do — never more — so keep it secret. Choose Revoke to stop a key working immediately.

If you don't see API keys, your instance's administrators have turned them off.

Your data

Settings → Your data is where you take your data with you, restore deleted workspaces, or leave for good.

Download your data

1. Choose Download my data.
2. sol2flow prepares a ZIP in the background. You get a notification and an email when it's ready.
3. Choose Download.

The ZIP contains your profile and preferences, your memberships and join requests, your comments, your time entries, your notifications, your sessions, passkeys and API keys (without any secrets), the security log of your account (sign-ins and security changes, with time and IP address), the devices and places you signed in from, and your profile photo. Only you can download it, for 7 days.

If the people running your instance have published a privacy policy, terms or an imprint, they're linked under Legal on the same page. How sol2flow handles your data: Privacy and GDPR.

To export a whole workspace, see Imports and exports.

Deleted workspaces

If a workspace you administer was deleted, it's listed here with who deleted it and when it will be purged. Choose Restore to bring it back before then.

Delete your account

1. Choose Delete my account… under Delete account.
2. Read what will happen. The dialog lists:
   • workspaces that block the deletion — where you're the only admin and other people still use them. Make someone else an admin (or delete the workspace) first;
   • workspaces that go with your account — where you're the only member. They can be restored by the instance's administrators for a while.
3. Type your username to confirm, and confirm it's you with your password.

You're signed out, and your profile, sign-in methods, passkeys, API keys, notifications and exports are deleted. This can't be undone.

Tasks, comments and time entries you created stay in their workspaces, shown as "Deleted user".