Login and security

Everything about how you sign in lives on Login & privacy: user menu → Account settings → Login & privacy, or https://lantfly.com/settings/security.

Confirm it's you (re-authentication)

Sensitive changes need a recent sign-in. If you signed in more than 15 minutes ago, those sections are locked and a banner asks for your password (plus your two-factor code when it is on). Confirming unlocks them for 15 minutes. If you linked Google or GitHub, you can confirm with that provider instead.

Changes that need a recent sign-in:

• changing your email
• turning two-factor sign-in on or off, and making new recovery codes
• changing the session expiration
• changing general resource access
• unlinking Google or GitHub

An API call made without a recent sign-in gets 403 with the error code reauth_required.

Email and password

Section	What you can do
Email	Change your sign-in email. You confirm the new address from the email we send
Login	Change password (current password, new password, repeat it), or Send email to reset password

warning

Changing or resetting your password signs out every session and revokes every API token of yours. It also disconnects every AI app connected through OAuth and forgets all trusted devices. Create new tokens afterwards.

Forgot your password while signed out? Use Forgot password? on the sign-in page. The link in the email lets you choose a new one.

If you created your account with Google or GitHub, you have no password yet. The reset email sets one.

Linked accounts (Google, GitHub)

Under Linked accounts you can Link or Unlink Google and GitHub, and see the linked email and when it was last used. You cannot unlink the only way you sign in: set a password first.

note

Signing in with Google or GitHub still asks for your Lantfly two-factor code when two-factor sign-in is on.

Two-factor authentication

Two-factor sign-in asks for a one-time code after your password. Pick one method:

Authenticator app (recommended)

1. Open Login & privacy → Two-factor authentication → Authenticator app → Enable.
2. Scan the QR code with your authenticator app or browser extension, or use Open in authenticator.
3. Enter the 6-digit code to confirm.
4. Save your recovery codes: Copy or Download them, tick I saved these codes, then Done.

Each recovery code works once in place of an app code. Make new recovery codes replaces them; the old ones stop working at once. Turn off disables two-factor sign-in.

Code by email

If you prefer not to use an app, choose Code by email (shown only while the authenticator app is off). We email you a 6-digit code to turn it on.

Detail	Value
Code length	6 digits, valid once, for 10 minutes
Emails per sign-in	At most 3 in 10 minutes (use Send again)
Wrong guesses	After 5 wrong guesses the code is dropped; request a new one

Turning the authenticator app on turns code by email off. You cannot turn code by email on while the app is on.

You get a security email whenever two-factor sign-in is turned on or off.

Trusted devices

When you enter a two-factor code you can tick Trust this device for 30 days. That browser then skips the code at sign-in for 30 days. The period does not extend when you use it.

You are still asked for a code to confirm sensitive changes, on any other browser, and after 30 days.

Login & privacy → Trusted devices lists each trusted browser with its device, IP address, when it was trusted, when it was last used and when it expires. Use Forget for one, or Forget all.

Trusted devices are forgotten automatically when you:

Event	Forgotten
Change or reset your password	All devices
Turn two-factor sign-in on or off, or set it up again	All devices
Sign out other sessions	All devices except the browser you are using

Sessions

Setting	What it does
Session expiration (days)	How long a dashboard sign-in lasts, from 1 to 365 days. Leave it empty for the platform default. It also applies to sessions already open
Active sessions	Each signed-in browser: device, IP address, when it signed in, last activity, when it ends. Sign out one session, or Sign out other sessions

A dashboard session that is not used for 30 days is signed out automatically.

info

Dashboard sessions are not API tokens. They are never listed on API & integrations, and API tokens are not listed here. See API tokens.

General resource access

General resource access decides who can read the storages (datasets, key-value stores) of the account you are working in, by their ID:

Option	Who can read
Restricted (default)	Signed-in users with access, an API token, or a signed link
Anyone with the id can read	Anyone who knows the storage ID, without a token or signature

Writing always needs a token. In an organization only the owner and admins can change this setting.

warning

Choose Anyone with the id can read only if the IDs you share should be public. Anyone holding an ID can then read that storage's items and records.

Security emails

We email you when:

• an API token is created on your behalf (name, account and expiry), even inside an organization
• an AI app is connected to your account through OAuth
• two-factor sign-in by email is turned on or off

If you did not do it, change your password at once. That ends every session and revokes every token.

API endpoints

These endpoints accept only a dashboard session. Any API token, even with full access, gets 403 session_required. A leaked token therefore cannot list your sessions, sign you out or create more credentials.

Endpoint	What it does
GET /api/v3/me/security	Sessions, trusted devices, session lifetime, general access
PUT /api/v3/me/session-lifetime	{"days": 1-365} or null
DELETE /api/v3/me/sessions/{id}, POST /api/v3/me/sessions/revoke-others	Sign out one session, or every other one
DELETE /api/v3/me/trusted-devices/{id}, DELETE /api/v3/me/trusted-devices	Forget one, or every, trusted browser
PUT /api/v3/account/general-access	RESTRICTED or ANYONE_WITH_ID_CAN_READ

Details are in the API reference.