Account and security

Profile and password

Change your name, e-mail address and password from your profile. E-mail changes require verification of the new address.

A password change signs out your other browser sessions, revokes connected apps and OAuth tokens, and synchronizes the new password to Forgejo. If the Forgejo account is missing, the profile page reports it and support can repair the link.

Two-factor authentication

Two-factor authentication uses a time-based code from an authenticator app. It is optional for customers and required for administrators.

• Recovery codes are shown once. Each code works a single time, so store them somewhere safe.
• If you lose both the authenticator and the recovery codes, support can reset the second factor after verifying you from the address on the account. The next sign-in asks you to set it up again.
• A reset clears the factor and signs out other sessions, so a remembered browser cannot skip re-enrolment.

Sessions

Settings, Connected apps and tokens lists the browsers signed in to your account. Sign out everywhere ends every session, including the current one.

Choosing Remember me at sign-in creates a long-lived cookie. Signing out everywhere rotates it, so a remembered device cannot sign itself back in.

Connected apps and MCP tokens

The same page lists every app that has access to your account, one row per app, with its scopes, tokens and last use.

• Disconnect revokes the app's consent and every token for it, on every device.
• Revoke stops a single token.
• Revoke everything stops all apps and tokens at once.

MCP tokens live in their own section of the page. See MCP server for client setup.

Data export

Your profile includes a JSON export containing profile data, billing details, subscriptions, orders and invoice links, sign-in history and connected apps. Use it to check what the account holds or to keep a copy before deleting it.

Repositories are not part of the JSON export. Clone or mirror them with Git.

Deleting your account

Account deletion is self-service from the profile. It:

1. stops the subscription,
2. removes the repositories and the Forgejo account,
3. erases personal data such as name, e-mail, username, billing and VAT details,
4. keeps invoices attached to an anonymized record for the period Dutch tax law requires.

Deletion cannot be undone. Export anything you need first.

Notifications

Plan, quota, billing and security messages appear in the notification centre. You choose which groups also arrive by e-mail. Security notices always arrive by e-mail.

Support

Mail info@stennmedia.nl from the address on the account. For security requests, say clearly what needs to change and expect a verification step before anything is reset.