Skip to main content

Password, 2FA, and sessions

Everything on this page lives under Account → Security and applies to you, across every workspace you belong to. Workspace-wide policy (such as an owner requiring 2FA for all members) is covered in Workspace settings.

Password​

If you signed up with email and password, Change password takes your current one and a replacement.

If you signed up with Google you don't need a password. You can still set one: Loha first asks you to confirm with Google, and, if you have two-factor authentication on, to enter an authenticator code. A password is worth having: it gives you a way in if you ever lose access to the provider account.

Forgotten the password you set? Forgot your password? mails a reset link to your account's email address. Use this rather than Change password, which needs the password you no longer have.

Sign-in methods​

Sign-in methods shows which OAuth providers are linked to your Loha account.

Linking a provider adds another way to sign in to the same account. It does not create a second account, and it doesn't change your email address or your workspace memberships.

You can unlink a provider as long as you'd still have a way in afterwards: either another linked provider, or a password. If a provider is your only sign-in method, set a password first; otherwise unlinking would leave the account unreachable, so Loha refuses it.

This is not the same as connecting a Git host

Linking a provider here is about signing in to Loha. Giving Loha access to your repositories is a separate, workspace-level connection with its own credential. See Repo hosts.

Two-factor authentication​

Rolling out

These flows are rolling out gradually and may not be visible on every account yet.

Enrolling shows a QR code for any TOTP authenticator app, then asks for a code to confirm the pairing.

Save your backup codes when they're shown. They are single-use, and they are the only way back into your account if you lose the authenticator device. You can regenerate the set later, which invalidates the old ones.

Signed in with Google only? Choose Confirm with Google to set up. After Google confirms it's you, scan the QR code, enter the first code, and save your backup codes. Your authenticator code is then what you use to confirm sensitive actions, such as creating an API key. To turn 2FA off or get new backup codes, Loha asks for an authenticator or backup code first.

Disabling 2FA is possible unless a workspace you belong to requires it. In that case the workspace mandate wins and you'll be asked to keep it enabled.

An accurate clock matters

TOTP codes are derived from the current time. If your device's clock drifts far enough, valid codes are rejected. Enable automatic time sync before assuming your authenticator is broken.

Active sessions​

Sessions lists everywhere you're currently signed in.

Revoke any one of them, or use Revoke all other sessions to sign out everything except the browser you're using right now. Your current session is never revocable from this list, so you can't accidentally lock yourself out mid-task.

Revoke everything else after using a shared or public machine, or if you suspect your password has leaked: changing the password alone does not end sessions that are already open.

Step-up re-authentication​

Some destructive actions ask you to confirm your identity again even though you're already signed in, deleting a workspace, for example. This is deliberate: it limits what someone can do with a session they've walked up to and found unlocked.

The confirmation dialog takes an authenticator code, a backup code, or your password, whichever your account has, with the authenticator offered first. Five wrong codes within 15 minutes pause code entry for 15 minutes and Loha emails you about it. If your account has none of these, the dialog sends you to set up 2FA.

See also​