Skip to main content
The security page is where you manage how you sign in and which sessions are active. Take a moment after signing up to enable two-factor authentication and review the session list.

​
Changing your password

Open Account → Security and click Change password. Enter your current password, then the new one. Archie signs out all other active sessions when the password changes — you stay signed in on the device where you made the change. If you signed up with Google or GitHub and never set an Archie-native password, the password section shows a Set password option instead.

​
Two-factor authentication

Two-factor authentication (2FA) adds a code from an authenticator app on top of your password. Enable it from Account → Security → Two-factor authentication. You scan a QR code with an authenticator app (Authy, 1Password, Google Authenticator), then enter a code to confirm. Archie generates 10 backup codes — store them in a password manager. Each code works once, in case you lose access to your authenticator. Multi-factor authentication is required on all Enterprise plans. On other plans it is optional but recommended.

​
Active sessions

The sessions list shows every device currently signed in to your account: device, browser, location (approximate, IP-based), and last activity. Sign out of any session you do not recognize by clicking Sign out next to it. Sign out all signs out every session including the current one.

​
Connected accounts

OAuth providers connected to your account (Google, GitHub) appear here with disconnect buttons. You cannot disconnect the only sign-in method on your account — set a password first, or connect another provider.

​
API keys

API keys for Archie itself are scoped per project, not per account, and live in project settings. The security page does not manage them.

​
Suspicious activity

If you receive a notification about an unfamiliar sign-in, change your password immediately and sign out all other sessions. Then contact support if you suspect your account has been accessed without your permission.