Profile, MFA and sessions# My profile, MFA and sessions ## Access and screen **Settings → My profile and MFA** is accessible to every user. It includes first name, last name, email, password, MFA TOTP and connected devices. ## Enable MFA Start setup, scan the QR code in a TOTP app, then confirm the six-digit code. Keep backup codes offline: each one is for one-time use. Deactivation requires verification. ## Sessions Each session indicates the device, status and current session. Revoke an unknown device or all other sessions. The refresh token is rotating, placed as an HttpOnly cookie; JWTs expire after 15 minutes. ## Common problems An off-set telephone clock invalidates the TOTP. After too many failures, the locking becomes progressive. The forgotten password route invalidates all sessions after reset. ## Manage your profile and password Correct first or last name then save. Email carries identity and notifications: avoid shared addresses. To change the password, provide the current value and then
RiskPilot
Website
FR
GitHub