Skip to content
Farlec docs

Account & security

Sign-in, two-factor authentication, sessions and account settings.

3 min read Updated

Sign in with Google or GitHub#

The sign-in and sign-up pages carry Continue with Google and Continue with GitHub buttons wherever they are enabled. One flow covers both: a connected provider signs you straight in, a new provider identity with an email matching a verified account connects to it automatically, and a brand-new identity lands on a short completion step (your name + the terms) before the account is created. Provider emails count as verified only when the provider confirms it; accounts created this way have no password — Settings can email you a link to set one at any time. Two-factor still applies: a provider sign-in on a 2FA account asks for your TOTP code. Manage connected providers from Settings → Connected providers — the last sign-in method can never be removed.

Email verification#

Sign-in stays blocked until your address is verified. At sign-up a 5-digit code arrives by email. Enter it on the sign-up page and a correct code signs you in straight away.

  • 5 digitsSingle-use code
  • 15 minutesBefore a code expires
  • 5 triesWrong entries before it dies

Codes are stored only as a hash, and resending invalidates the earlier code. Password reset and email change use 24-hour, single-use links that always live in the URL path, never as query parameters. Changing your email is double-opt-in: the new address confirms, and the old one gets a security notice.

Passwords#

Passwords are 10–200 characters with no composition rules; length is the requirement. They're stored with argon2id. Changing your password revokes your other sessions, and a reset revokes all of them. Password reset requests look identical whether or not the address exists, so accounts can't be enumerated.

Two-factor authentication#

  1. Enable TOTPOpen Settings → Security. The secret stays staged until a valid code confirms it.
  2. Save your recovery codesYou receive 5 single-use recovery codes.
  3. Sign in with a codeLogin with 2FA on hands you a short-lived challenge token (5 minutes, 5 attempts).

Disabling 2FA asks for your password plus a code. If you lose everything, support can reset 2FA with a recorded reason, which revokes your sessions.

Sessions#

Sessions live in a __Host- cookie — httpOnly, secure, site-locked — and last 30 days with sliding renewal. Status checks happen every request, so bans and deactivations take effect immediately. The session list is server-side only; there is nothing to manage client-side beyond sign-out.

Login alerts#

First sign-in from a new country emails a security alert to you. The baseline seeds silently from your first login; travel with a VPN and expect a notice.

Profile#

Your profile holds first name, last name, a display name, optional phone/company and an optional postal address. The About field is a markdown bio that will ride along when you publish templates. Avatars upload to platform storage (images only, 2 MB) and fall back to a generated identicon of your email.