Skip to main content

Account & security

Your TokenTimer account controls sign-in, security settings, and personal data. All settings below are in Account settings in the dashboard.

Sign-in methods​

  • Email and password: standard local accounts. New accounts must verify their email address before they can receive alert deliveries; verification links expire after 24 hours and can be re-sent from the banner or the login screen.
  • Google: sign in or register with a Google account. Google accounts are already verified and do not use TokenTimer passwords or TokenTimer 2FA (Google handles those).

Two-factor authentication (2FA)​

2FA adds a time-based one-time password (TOTP) requirement to email-and-password logins. Any authenticator app works (Google Authenticator, Authy, 1Password, Bitwarden, and similar).

Enabling 2FA​

  1. In Account settings, open the security section and start 2FA setup.
  2. Scan the QR code with your authenticator app (or enter the secret manually). The account label is TokenTimer:<your email>.
  3. Enter the 6-digit code from your app to confirm. 2FA is now active.

Logging in with 2FA​

After entering your email and password, you are prompted for the current 6-digit code from your authenticator app.

Disabling 2FA​

Disabling 2FA requires your current password. Other active sessions are invalidated when 2FA is disabled.

warning

If you lose your authenticator, use password reset: resetting your password through the email link also offers to clear 2FA so you can regain access, since it proves control of the account email.

Password​

Passwords must be at least 12 characters and include an uppercase letter, a lowercase letter, a number, and a special character. Common patterns and long character repetitions are rejected.

  • Change: in Account settings, provide your current password and the new one. All password reset tokens are invalidated on change.
  • Reset (forgotten password): request a reset link from the login page. The link is valid for 5 minutes and can be used once. During reset you can optionally clear 2FA (see above).
  • Google accounts have no TokenTimer password; manage credentials in Google.

Data export​

You can export your data as JSON at any time (also available via GET /account/export on the API):

  • User scope (default): your profile, user settings, and all workspaces you belong to. Viewers only get their personal workspace content.
  • Workspace scope: a single workspace's settings, contact groups, workspace contacts, and tokens (admin, workspace manager, or owner; webhook URLs are hashed in the export).
  • Organization scope: all workspaces where you are admin or workspace manager.

Activity history is a separate audit export (GET /account/export-audit), available on Pro and Team plans. See Audit.

Deleting your account​

Account deletion is permanent and immediate:

  1. In Account settings, choose Delete account. You can optionally leave feedback (recorded as an ACCOUNT_DELETION_FEEDBACK audit event before the account is removed).
  2. Any active Stripe subscription is cancelled immediately.
  3. Workspaces you own are deleted, including their tokens, settings, contacts, and memberships. If you are the sole admin of a workspace that has other members, deletion asks you to confirm force-deleting those workspaces or to transfer ownership first.
  4. Your user record is anonymized: personal data (email, name, password) is irreversibly scrubbed. Sessions, 2FA secrets, and pending tokens are removed.

Export your data first if you need a copy; deletion cannot be undone.