Account and security
What this covers: two-factor authentication, passkeys, signed-in devices, API tokens, and the audit log. Everything here lives under Settings → Security unless noted.
Two-factor authentication
- Settings → Security → Two-factor authentication.
- Scan the QR code with any authenticator app and enter the six-digit code to confirm.
- Save the ten backup codes. They're shown once, each works once, and they're the way back in if you lose the phone.
An emailed code is available as a fallback if you have neither the app nor a code left.
Passkeys
A passkey signs you in with Face ID, Touch ID, or your laptop's unlock instead of a password. Add one per device; add a second so a lost phone isn't a lockout. Removing a passkey takes effect immediately.
Devices
Security lists every signed-in device with when it was last seen. Revoke any of them — the session dies on the next request, not at some expiry.
API tokens
Settings → Developer → API tokens. Each token is limited to what you
allow: read and write are separate for exercises, workouts, sessions, measurements, the
marketplace, and the social surface, and export, import, and admin are their own. A
read-only token is sessions:read plus whatever else you actually need —
nothing more.
The token is shown once at creation. Revoke it whenever; anything using it stops working on the next call.
The audit log
Every mutation is recorded: what changed, when, and which credential did it. Agent and CLI actions show up there exactly like taps in the app do, so a token you forgot about is visible rather than invisible.