← Back to Help Center

Account

Email, deletion, sessions, OAuth apps, signing keys, and exports.

MDX content system unavailable: the @next/mdx compiler is not installed, so this article is shown as source text instead of compiled MDX. Nothing is broken — install it with npm i @next/mdx @mdx-js/loader @mdx-js/react @types/mdx to render the full MDX version.

Account

How do I change my email address?

Go to Settings > Account > Profile. Click Edit next to your email address and enter the new one. You will receive a confirmation link.

How do I delete my account?

Go to Settings > Account > Danger Zone and click Delete Account. This action is permanent and cannot be undone.

How do I review and revoke signed-in sessions?

Open Settings > Security > Sessions to see every device signed in to your account, with IP address and expiry. Click Revoke next to one device, or Revoke others to sign every other device out immediately.

How do I register a third-party OAuth application?

Open Settings > Security > OAuth Applications. Enter an application name, an https redirect URI, and comma-separated scopes, then click Register. The client secret is shown once, so store it now. Use Get code for a single-use 10-minute authorization code, or Revoke to disable an app.

How do I create a signing key for script registration?

Open Settings > Security > Signing Keys. Enter an optional label and click Generate. Key pairs are Ed25519 and only the public key is persisted in your account. The private key is shown once, so copy it immediately. Delete removes a key you no longer use.

Where do I see my API keys and data exports?

Open Settings > Security > Developer for a read-only overview of your API keys, OAuth applications, and data export requests. List responses carry key prefixes and scopes only; full secrets are never returned. Manage exports from Settings > Privacy.

Securing your account with 2FA (TOTP)

Set up time-based one-time passwords via POST /api/auth/2fa/setup (issuer IDEOSCREEN). Setup is rate-limited to 10 attempts per 15 minutes per user/IP and requires a signed-in session. Complete verification and challenge steps at the sibling 2fa routes.

Requesting a GDPR export of your data

List past requests with GET /api/privacy/export and file a new one with POST /api/privacy/export (handled by gdprManager, CSRF-protected and rate-limited). Download the finished bundle at /api/privacy/export/download.