An account you can manage.
Sign in, enroll an authenticator and manage recovery through real account forms.
Start with an existing account
Open /account/login and sign in with a CLI-provisioned account. The Account link appears in the main navigation. There is no default account or public registration. The account page requires a valid server-side session. JavaScript submits same-origin JSON through the existing CSRF-protected APIs; errors and pending states are visible and keyboard accessible.
Enroll and save recovery codes
Choose Set up authenticator, confirm your password, and add the private setup key to a time-based authenticator account. A compatible app can also open the otpauth link. Enter your password again and a fresh six-digit code to enable verification. The page displays ten recovery codes once, with an explicit Download codes button. Save them privately before leaving. Enrollment signs out every session. No external QR service receives the secret.
Change security settings
The account page shows current MFA status and remaining recovery-code count. Password changes, code replacement and factor removal require password reauthentication and an enrolled factor. Codes already consumed for sign-in cannot be reused. Each successful security change signs out every session. The screen tells you when to sign in again.
Reset with a privately delivered token
The reset page accepts a token from your administrator and a confirmed new password. It does not issue tokens or send email. Tokens are entered in a password field and sent in the POST body; they are not placed in URLs. Reset keeps existing MFA enabled.
Browser boundaries
Account responses use no-store and no-referrer. Passwords, setup keys and recovery codes remain in the current form or response memory; no localStorage/sessionStorage is used. Leaving the page clears sensitive controls and persisted back-forward pages reload. A deliberate recovery-code download creates a plaintext file on the user’s device. Protect and remove that file according to your own policy.