# Account security (/docs/getting-started/account-security)

Open the menu under your name at the bottom of the sidebar and choose **Account & security**. It has three sections: **Profile**, **Sign-in & security** and **Sessions**. Everything there applies to your account in every organization you belong to.

## Profile [#profile]

Change your name: it saves when you press Enter or click away. Your teammates see it in **Members** and in **Activity**. The page also lists your organizations and your role in each.

## Password [#password]

**Sign-in & security → Change password.** Enter your current password and the new one. Leave **Sign out everywhere else** on to end every other session at the same time.

## Passkeys [#passkeys]

A passkey lets you sign in with your fingerprint, face, device PIN or a security key instead of a password. It's tied to RoChart's domain, so a phishing site can't use it.

- **Add one:** click **Add passkey**, name it (for example "MacBook" or "YubiKey"), then confirm on your device. Add one for each device or password manager you use.
- **Sign in:** click **Sign in with a passkey** on the sign-in page, or pick the passkey from the email field's autofill suggestions.
- **Remove one:** click **Delete** next to it. Also delete it from your device or password manager.

Passkey sign-in never asks for a two-factor code. The passkey already proves you have the device and can unlock it.

## Two-factor authentication [#two-factor-authentication]

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app (1Password, Google Authenticator, Authy…) whenever you sign in with your password.

<Steps>

### Turn it on [#turn-it-on]

Click **Set up two-factor** and confirm your password. A progress bar shows the four steps.

### Add RoChart to your app [#add-rochart-to-your-app]

Scan the QR code with your authenticator app, or paste the setup key shown next to it. On a phone, tap the link to open your authenticator directly. Then click **I've added it**.

### Enter the code [#enter-the-code]

Type the 6-digit code your app shows. Two-factor turns on as soon as the code is accepted. Closing the dialog before this step changes nothing.

### Save your backup codes [#save-your-backup-codes]

You get ten backup codes, shown once. Copy or download them, keep them somewhere safe such as your password manager, and tick the box to finish. Each code signs you in once if you lose your phone.

</Steps>

When you sign in with your password, RoChart then asks for the code. Tick **Trust this device for 30 days** to skip the code on that browser for the next 30 days. Click **Use a backup code instead** if you don't have your phone.

**Get new codes** replaces all of your backup codes with ten new ones. **Turn off** disables 2FA. Both ask for your password.

## Sessions [#sessions]

**Sessions** lists every browser and device signed in to your account, with when it was last active. **Sign out** ends one session; **Sign out other sessions** ends all of them except the one you're using. If you see one you don't recognise, sign it out and change your password.

<Callout type="warn" title="Lost your phone and your backup codes?">
  Sign in with a passkey if you have one, then turn two-factor off and on again to set up a new phone. If you have neither, ask the person who runs your RoChart instance to reset your account.
</Callout>

API keys (`rc_sk_…`) and MCP connections aren't affected. They authenticate with the key, not your sign-in.