Your account, your access.
Manage optional profile details, active sessions and passkeys in Account settings. These operations require your authenticated app session, independently of the selected workspace.
01Keep signup simple
Your verified email starts the account. A display name is optional. Verified email changes and lost-all-passkey recovery are not available through these endpoints. Email possession alone cannot reset existing passkeys.
02Know your service coverage
Service access in Account settings records your self-confirmed country of residence and the published service scope. Confirmation uses an app session and an Idempotency-Key; accounts with existing passkeys require recent passkey verification. It is a residence declaration, not verified identity. Country coverage can be supported, restricted, paused or not configured. Production access remains inactive independently of country coverage.
03Add a backup passkey
The first passkey uses your email session. Additional passkeys require fresh verification with an existing active passkey. You can keep ten active passkeys. Retired credentials remain in security history and cannot be reused.
04Revoke a device deliberately
Verify with a different active passkey before revoking an old key. The last active passkey is protected. Revocation signs out all your other app and operator sessions. It does not revoke API keys or cancel submitted payments; review Developers separately.
05Recover an interrupted setup
Keep the registration challenge UUID before submitting verification. If its response is lost, call the recovery endpoint with a stable Idempotency-Key. It returns registered if enrollment committed, or fences an unfinished challenge before another setup. It does not grant or refresh passkey approval.
06Review your activity
Current session, other active/past sessions and security history are scoped to your account. Follow nextCursor with before for more records. Browser names are reported hints, not device identity. Timestamps are UTC.
07Preserve the original request
All profile and access POSTs require an Idempotency-Key. Retry an unknown result with exactly its original body and key. Profile changes also include expectedRevision to avoid overwriting another change.
// App-session operations. POST requests require an Idempotency-Key.
GET /v1/account/security
POST /v1/account/profile
{ "name": "Optional display name", "expectedRevision": 1 }
GET /v1/account/security/sessions?status=active&limit=20
POST /v1/account/security/sessions/{id}/revoke
{ "reason": "Retire the old browser session." }
POST /v1/account/security/passkeys/{reference}/label
{ "label": "Travel security key" }
POST /v1/account/security/passkeys/{reference}/revoke
{ "reason": "Retire this key after verifying a separate active key." }
POST /v1/account/security/passkey-registrations/{challengeId}/recover
{}
// Response: { status: "registered" | "not_registered", passkeyId: string | null }
GET /v1/account/security/history?limit=20
GET /v1/account/service-country
POST /v1/account/service-country
{ "countryCode": "ID", "expectedRevision": 0, "confirmed": true }
// Returns residence declaration and country coverage separately from production activation.Open your workspace