Documentation

Account recovery.

This page covers your billing portal login only. Your HSM environment has its own separate sign-in with its own recovery, described in Getting started. A lost billing portal password never touches your keys.

One button, two paths

The portal sign-in page has one recovery control: “Forgot password?”. You enter your email and nothing else. We look at the account behind that address and email you the step that actually applies to it.

There are two possible steps. An account that can reset itself receives a reset code. Every other account receives a link that opens a support request for you. You do not choose between them and you do not need to know which one you are before you start.

Who resets their own password

Two things must both be true. Your account has an authenticator enrolled, and you can open that authenticator right now and read a current six digit code from it.

Enrollment on its own is not enough. We ask for a live code during the reset, so a reset cannot finish for an account whose authenticator was lost, wiped, or left on a replaced phone. If that is you and you still know your password, do not start a reset: use a backup code instead, as described in Losing your authenticator.

Resetting your password

Have your authenticator open before you begin. The reset asks for a code from it in the same step as your new password. Codes roll over roughly every thirty seconds.

1. Ask for the email. On the portal sign-in page, choose “Forgot password?” and enter your email address.
2. Copy the reset code. Open the email we send and take the code out of it.
3. Fill in all four fields. The email links straight to this step. You can also reach it from the sign-in page by choosing “I have a reset code”. Enter your email, the reset code, a current code from your authenticator, and your new password.
4. Sign in. Use the new password. Your authenticator answers the usual prompt afterwards.

Your new password needs at least twelve characters with an upper case letter, a lower case letter, a number, and a symbol. Your existing authenticator enrollment survives the reset, so you are not asked to scan a new QR code afterwards.

When it becomes a support request

If your account cannot reset itself, the email you receive carries a link rather than a code. Clicking that link opens a support request on our side, already filled in with what we need to work on it. You never write a message, quote an account number, or describe your problem to us.

The link works once and stays valid for 24 hours. After you click it, the portal confirms that your request is open, and we reply to the same address the link was sent to.

What you need on hand: access to that mailbox, and nothing else. Support verifies the account before changing anything on it, so expect that verification step rather than an immediate reset.

Losing your authenticator

Backup codes are how you get back in without your authenticator. When your account has none unused, the portal offers a set of ten as soon as you sign in. They are shown once. Save them somewhere other than the phone that holds your authenticator. We keep only a keyed fingerprint of each code, so we cannot show them to you again.

To use one, go to the portal sign-in page, enter your email and your current password, and at the authenticator prompt choose “Lost your authenticator? Use a backup code”. Enter one code.

A backup code only works together with your current password, and the form answers the same way for every failure without saying which part was wrong. Enroll a second administrator with their own login, their own authenticator and their own backup codes. A lost authenticator then stops being an outage for your account.

Which path to take

Forgotten password, authenticator in your hand: the reset. Known password, authenticator gone: a backup code. Both finish without us.

An invitation you never finished, an account someone disabled, or an address you are no longer sure we hold goes to a support request. Use the recovery button for those. It routes you.

For a question that is not about getting back in, use the contact form instead. It reaches the same people without consuming a recovery link.

When something does not go to plan

The email never arrives. Check spam first. We accept one recovery request per address every ten minutes, so an immediate second attempt is quietly ignored rather than sent. Wait ten minutes and request again. If the second one does not arrive either, the address may not be the one on your account. Use the contact form from a different address and say which account you are asking about.

The reset code expired. Reset codes are short lived by design. Request recovery again and use the newer email. Older codes stop working once a newer one is issued, so always work from the most recent message.

The reset was refused. The form reports one message for every cause and does not say which of the four fields failed. Do not re-enter the same reset code. A reset code is spent by the attempt that used it, whether or not that attempt succeeded, so a second try with the same code cannot work. Request recovery again and work from the newer email.

Your authenticator code was the problem. When the reset code was right and the authenticator code was not, the reset stops and we email you to say so. Treat your old password as gone: the reset had already replaced it. If you still have your authenticator, request a new reset and enter a current code from it.

The support link says it is invalid. Each link works once and expires after 24 hours. If you already clicked it, your request is open and no second click is needed. If it expired, request recovery again for a new one.

You expected a code and got a support link, or the reverse. The email reflects what your account looked like at that moment. An authenticator enrolled on a device you no longer have still reads as enrolled to us, which is exactly the case the live code check is there to catch. Follow whichever instruction the email gives.

Why this screen gives no answer

A recovery page that answered differently for a real address than for an invented one would let anyone test addresses against it and learn who has an account with us. That is a list worth stealing, and building it would take an afternoon.

So we show one answer to everyone. The specifics go to your mailbox, where reaching them means already controlling the address. The cost is that you cannot tell from the screen whether we recognized your email. We think that trade is the right way round. We would rather explain it here than quietly make this screen more helpful to an attacker.