Account & Security

Everything you can do to your account itself lives under Dashboard → Account. Three sub-pages:

• Settings: change your display name, email, password, and profile photo.
• Security: see your recent sign-in history.
• Sessions: see every device that's logged in and revoke any you don't recognise.

This page covers what you can do, in what order, and what to watch for.

Changing your display name

Settings → Display name.

Type the new name (up to 80 characters) and click Save. The change is immediate, visible in your account menu and on your projects. There's no email confirmation step. Display names aren't security-critical.

Changing your email

Settings → Email address → Change.

The flow is built to prevent a stolen account session from quietly changing the email and locking you out:

1. Type the new email.
2. Type your current password to confirm.
3. We send a confirmation link to the new email.
4. The change only takes effect after you click that link.

While the change is pending, you'll see a yellow banner showing what's pending and a Cancel pending change button. Clicking it withdraws the request immediately. Useful if you typed the wrong address or changed your mind.

If you signed up with a third-party provider (Google, Apple, GitHub) and don't have a password, you'll see a prompt to set a password first before changing your email. The password protects the email change.

Changing your password

Settings → Change password (or Set a password if you signed up via OAuth and don't have one yet).

For users with a password already:

1. Enter your current password.
2. Enter a new one. It must be at least 10 characters (max 72), contain at least one letter and one number, and isn't allowed to: match a common-password blocklist, equal or include the local part of your email, or have leading/trailing whitespace.
3. Confirm it.
4. Click Update password.

One important thing happens after a successful change: every device you're logged in on, including this one, gets logged out. You'll be sent back to the sign-in screen and need to log in again with your new password. This protects you if your password is being changed because you suspect a leak - any session that might be in someone else's hands is killed in the same step.

For OAuth-only users setting their first password:

The form skips "Current password" since you don't have one. Setting the password is additive. Your Google/Apple/GitHub sign-in still works afterwards. You just now have an additional way to sign in.

We send a confirmation email after the password is set. If you didn't initiate it, the email tells you how to revoke immediately.

Profile photo

Settings → Profile photo.

Upload via drag-and-drop or click. The image is cropped to a circle and shown in your account menu, on your projects, and anywhere your account is referenced. Drop a new image any time to replace the previous one.

Active sessions

Security → Manage sessions (or directly at Dashboard → Account → Security → Sessions).

Every device or browser currently logged into your account shows up as a row, with:

• Device summary. "Chrome on macOS," "Safari on iOS," etc.
• IP address: useful for spotting unfamiliar locations.
• Last active: when this session was last used.
• MFA badge: if the session was elevated to MFA-protected.
• "This device" badge on the row that represents your current browser.

Two actions:

Revoke a single session

Click the Revoke button on any row except your current one. That device is immediately signed out. If they're using your account, they're back to a sign-in screen on the next request.

Revoke everything

The Log out everywhere button at the top revokes all sessions, including your current one. You'll be sent to the sign-in screen.

Use this if you've ever worried about a stolen session, a phone you can't unlock, or a public computer you forgot to sign out of. There's no downside: you can always sign in again.

Sign-in history

Security shows your recent authentication events: every sign-in, sign-out, password change, email change, session revoke. Useful for spotting suspicious activity.

Each row has:

• A coloured tag: green for routine sign-ins, yellow for important changes (password change, email change), red for high-risk events (account deletion request).
• What happened. "Email and password log-in," "Magic link log-in," "Password changed," etc.
• The IP and browser for that event.
• The exact time plus a relative "2h ago."

The summary card at the top highlights your most recent log-in. If you don't recognise it, change your password and log out everywhere immediately.

Scroll down for older activity, or click Show older at the bottom for a paginated view of even older events.

Two-factor authentication (2FA / MFA)

If your account has been elevated to MFA via Supabase Auth (using an authenticator app like Google Authenticator or 1Password), the sessions list shows an MFA badge on sessions that completed the second factor.

The full MFA enrolment flow happens through Supabase Auth. If you want MFA on your own Appsanic account, contact support. Managed MFA enrolment from the dashboard is on the roadmap.

(Note: MFA for your app's users - the people signing into the app you build with Appsanic - is something the agent can wire up for you. See Authentication.)

Export your data

You're not locked in. You can request a full export of your data at any time - a complete JSON file of your account and its content (projects, prompts, conversation history, and metadata). It's a good thing to grab before a big change, or just to keep a copy of your own.

Most of your code already lives in your GitHub and Supabase accounts, both of which you control, so the export mainly covers what sits on our side. For the full picture, including how it ties into account deletion, see Deleting Your Account.

Things that catch people out

• Email-change link expired. Confirmation links expire. If yours has expired, start the change again from Settings.
• Password change logged me out everywhere, including this browser. Yes, that's the design. Sign back in with your new password on the devices you actually use.
• "Revoke" button is disabled on one row. That's the row for your current session. Use Log out everywhere if you really want to revoke that one too.
• Sign-in from an unfamiliar IP. IPs can shift legitimately (your phone on a new wifi, your laptop on a VPN). But if the location feels wrong, treat it as a signal: change your password and revoke sessions.

Tips

• Review sessions every few months. Especially if you switched devices, used a friend's laptop, or signed in from a coworking space.
• Set a password even if you sign in with Google. Belt-and-braces. If your Google account ever has issues, you can still get into Appsanic.
• Treat the security log like a journal. Glance at it once in a while. If anything looks off, act on it then, not later.

Under the hood (for engineers)

• Account changes (display name, email, password) go through /api/account/profile, /api/account/email, /api/account/password respectively. Each is CSRF-protected and runs under the user's authenticated Supabase session.
• Email change uses Supabase Auth's built-in change flow: auth.users.email_change_token_new until the user clicks the link in the new inbox.
• Password change explicitly invokes Supabase Auth's global sign-out scope so all refresh tokens are invalidated, then clears the local CSRF token and redirects to /login.
• Sessions list reads from auth.sessions filtered to the current user; revocation hits auth.admin.signOut(sessionId, { scope: 'local' }) on the server.
• Auth events are written to a custom auth_events table with the event type (signed_in, password_changed, etc.), IP, user agent, and a JSONB details column for variant-specific data (the new email on email_changed, the provider on signed_in_oauth).

Next

If you need to wipe your account entirely, read Deleting Your Account. For payments and plan changes, see Plans and Billing.