Account & security
How you sign in, how two-factor works, and how to get back in when something goes wrong.
Signing in#
Three ways in, all to the same account:
| Method | Notes |
|---|---|
| Email and password | Passwords are hashed with argon2id and verified in constant time. We cannot read your password, and no one at Blopus can tell you what it is. |
OAuth, scope openid email profile. We use the email address to identify the account. No access to Gmail, Drive or contacts. | |
| GitHub | OAuth, scope read:user user:email. user:email is required because GitHub serves verified addresses from a separate endpoint. No access to your repositories. |
The provider does not create a second account. Signing in with Google using the same address as an existing password account lands you in that account. One email address is one account, however you arrive.
Passwords#
- Change it from Account & Security in the console. Changing it requires your current password.
- Forgotten it? Use Forgot password on the sign-in page. The link is emailed, single use, and expires.
- If you signed up with Google or GitHub you may not have a password at all. Set one from the console if you want a second way in.
Two-factor authentication#
Blopus uses standard TOTP — the six-digit rotating code. Any authenticator app works; there is nothing Blopus-specific to install:
- 1Password, Bitwarden, or your password manager's built-in authenticator
- Apple Passwords (iOS/macOS), Google Authenticator, Microsoft Authenticator
- Aegis or Raivo, if you want the codes to stay on one device
Turning it on shows a QR code and the secret in text, for apps that cannot scan. The account appears in your app as Blopus.
Clock skew is tolerated. A code from the previous or next 30-second window is accepted, so a phone that drifts by a few seconds still works. If codes are rejected consistently, your device clock is wrong by more than that — enable automatic time and try again.
Recovery codes#
Enabling 2FA issues 10 recovery codes, each formatted
XXXXX-XXXXX. They use an alphabet with no
0, O, 1,
I, L or U, so a
code read off a screen or a printout cannot be mistyped into a different valid code.
- Each code works once. Using one consumes it.
- They are shown once. We store only hashes — if you lose them, no one can recover them, and you regenerate a fresh set instead.
- Spending your last code issues a new set automatically, shown to you on the spot. You are warned when 2 or fewer remain.
- Entering one is forgiving: spaces, dashes and lower case are all accepted.
Print them, or put them somewhere that is not the phone holding your authenticator. A recovery code stored only on the device you are trying to recover is not a backup.
Locked out#
In order of how much you will enjoy them:
- A recovery code at the 2FA prompt. Instant.
- Turning 2FA off from the sign-in flow. We email a one-time code to your account address; it is single use and consumed the moment it matches.
- Support — open a request. Slowest, because proving who you are takes longer than proving you hold a code.
API keys#
Keys are shown once, at creation. We store only a hash and the short prefix, which is what you see listed afterwards and what you quote in a support request.
If a key leaks, revoke it in the console — revocation takes effect immediately. Rotate rather than share: a separate key per application means you can revoke one without breaking the others.
Deleting your account#
Deletion is available in the console. It removes your support threads and recovery data, and detaches your identity from historical usage records. Billing records that we are required to retain for tax purposes survive, as they must for any business.
Cancelling a subscription and deleting an account are different things — see Billing.