Account settings and security
Manage profile, email, sessions, passkeys, connected accounts, preferences, and notifications.
Account settings belong to one person across every organisation. They are separate from organisation identity, roles, billing, and project configuration.
Use account settings to manage how you sign in, which sessions remain trusted, and how the console behaves for you.
General settings contain display name and sign-in email. Changing email requires verification and an additional identity confirmation appropriate to the current account.
An organisation invitation email and account sign-in email can follow different verification paths during joining. After account creation, protected email change remains an account security action.
Profile changes do not rename organisations or alter membership roles.
Gravatar display is opt-in. FeatureGate derives the SHA-256 email hash server-side when rendering the console and stores only the display preference.
Gravatar is never an authentication, identity, or account-recovery provider. Disable the preference when you do not want the external avatar request.
Passwordless email code remains the baseline sign-in method. Google and GitHub can provide optional alternative sign-in when the provider is configured.
Connecting Google or GitHub verifies an authentication identity. It does not grant FeatureGate access to repositories or automatically authorize an organisation role.
Review connected accounts after provider access changes. Keep at least one usable sign-in method during recovery work.
Passkeys are account-level WebAuthn credentials. Registration and authentication require user verification and create the same server-side console session records as other sign-in methods.
Name a passkey after the device or authenticator so it can be identified later. Remove lost or retired credentials promptly.
Keep another sign-in method available. A passkey is convenient primary authentication after setup, not a reason to discard every recovery path.
Security settings list active browser sessions. Revoke devices or browsers you no longer trust.
Session revocation affects console authentication. It does not revoke runtime, client, or management keys, which have separate lifecycle and ownership.
If compromise is suspected, revoke sessions, review connected accounts and passkeys, then inspect organisation activity and credentials the account could administer.
Theme, timezone display, motion, and keyboard-hint preferences affect only the signed-in console experience. They do not change evaluation, audit timestamps, or other members' settings.
The Organisations page shows each membership, role, and accepted member count. Eligible non-owner team members can leave from this account-level view.
Personal members, owners, and sole team members cannot leave. Ownership must transfer before an owner can depart.
Optional account-wide categories cover:
Authentication, security, invitations, changes to your own access, roles, removal, and ownership remain mandatory. Optional preferences apply across every organisation.
Related pages: Roles and permissions, Invite and manage a team, and Activity and audit history.