Account & auth

The Account & auth methods section of Settings is where you manage how you sign in and, if you ever need to, delete your account. The settings here are managed by the AccountMethods component.

Sign-in methods

You can use any combination of the following to access your account:

Method	How it works
Email & password	Classic credentials — an email address and a password you set.
Google (OAuth)	Sign in with your Google account; no separate password needed.
Magic link	Receive a one-time sign-in link by email and click it to log in.

The section lives above everything else in Settings because it belongs to you, not to the active workspace. The unlink button is disabled here: an account cannot be left with no way in. The address is masked.

Tip

Linking more than one method gives you a fallback — for example, set a password as well as Google OAuth so you can still sign in if one method is unavailable.

Managing your methods

1. Open Settings and go to Account & auth methods.

2. Add or update a method — set or change your password, connect Google, or enable magic link sign-in.

3. Save your changes. They take effect on your next sign-in.

Danger zone: deleting your account

The danger zone lets you delete your account. This is permanent and removes your access.

Caution

Account deletion cannot be undone. Make sure any data you want to keep is exported first, and that team resources you own are transferred or no longer needed before you proceed.

Access tokens

To use the REST API, the Python package or the MCP server from outside the app without a session that expires every hour, mint an access token here.

1. Give it a name that says where it will live (laptop, Claude Code) and how many days it should last (1–365, default 90).

2. Copy it when it is shown. It is shown once; afterwards the list only knows its name, when it expires, and when it was last used.

3. Revoke it from the list when that machine is gone. A revoked token stops working on the next request and stays listed, struck through, for thirty days as a record.

Caution

An access token acts as you: anything done with it — a move written, a dataset deleted — is yours. Treat it like a password, and never put it in a script that is committed.