Skip to main content
This page covers the security of your own Zespan sign-in. Everything here lives under Settings → Profile → Security and applies to you alone. For how Zespan protects your data, see Security. To require two-factor authentication from your whole team, see Organizations.

​
Change your password

If you sign in with an email and password, the Password card lets you change it while signed in.
1

Enter your current password

You must know it to change it. A wrong current password is refused with “Your current password isn’t right.”
2

Choose a new password

Use 12 to 128 characters, and type it twice. A mix of letters, numbers, and symbols is recommended, and so is avoiding common words and your own name or email.
3

Decide about your other sessions

Sign out of all my other sessions is ticked by default. Leave it ticked if you think someone else might have had your old password.
If you sign in with Google, GitHub, or Microsoft, the card says so and there is no Zespan password to change; manage it with that provider. If you forgot your password, use Forgot password on the sign-in page instead.

​
Two-factor authentication

Two-factor authentication asks for a code from an authenticator app (Google Authenticator, 1Password, Authy, or similar) every time you sign in.
1

Start setup

Click to turn on Two-factor authentication. If you sign in with a password, enter it to continue.
2

Scan and confirm

Scan the QR code with your authenticator app, then enter the 6-digit code it shows.
3

Save your backup codes

The backup codes are shown only during setup. Copy or download them, then tick I’ve saved my backup codes. Each can be used if you lose your phone. If you leave before confirming, two-factor stays off and you start again.
To turn it off, use the same card; you confirm with your password if you sign in with one. Your backup codes stop working when you turn it off.
If an organization you belong to requires two-factor authentication, only an authenticator app satisfies it. Email one-time codes don’t. See Organizations.

​
Where you’re signed in

Where you’re signed in lists every active session on your account: browsers and CLI terminals.
  • Sign out next to a session ends it right away. You can’t sign out your current session from this list; use the normal sign-out instead.
  • Sign out all other sessions ends every session except this one, terminals included.
If you don’t recognize a session, sign it out and then change your password. Session tokens are never shown, and you can only see and end your own sessions. Each sign-out is recorded in the audit log as user.session_revoked.

​
Terminals (CLI)

Terminals (CLI) lists the machines you authorized with zespan auth login. Each shows its operating system and CLI version, a short key fingerprint, when it was first and last seen, and how many sessions it currently holds. Revoke signs the terminal out and ends every session it holds. A revoked terminal can’t sign itself back in: the CLI explains how to start fresh — see zespan auth → When a login fails. Revoking is recorded as user.cli_device_revoked. These lists stay available even when your organization requires two-factor authentication and you haven’t enrolled yet, so you can always end a session.

​
From the API

These routes act on the signed-in user and authenticate with your dashboard session (browser cookie), not x-api-key.

​
Next steps

  • Privacy — your privacy choices, data export, and account deletion
  • zespan auth — sign the CLI in and approve a terminal
  • API keys — project keys and personal keys for MCP
  • Organizations — require two-factor for your team