# Account settings *Account settings* is the home of everything about your account itself, rather than the buckets and keys inside it: the email address we write to, the extra protection of two-factor authentication, and closing the account when you no longer need it. You can open it from the avatar menu in the dashboard. It has three sections: *Email address*, *Two-factor authentication* and *Danger zone*, which is where an account is closed. Because each of these changes how someone gets into your account, every action here is a dialog that walks you through a few verification steps, one code at a time - emailed to you, or shown by your authenticator app. That way a signed-in browser alone is never enough to change who owns the account. The dialog shows which step you are on; the steps come in the order shown below, and each one is needed. An emailed step waits for you before it sends anything. It says *We will email a code to* the address, and shows a quick security check - that usually completes by itself, and now and then asks for a click. Once it has passed, the **Send code** button sends the email, and the code from it goes into the field, followed by **Verify**. **Send a new code** runs the security check again first. ## Changing your email address Your account's address is where sign-in codes, invoices and everything else about your account arrive, so it is worth keeping current - after a change of job, say, or a move to a shared team mailbox. The **Change** button under *Email address* opens the dialog, where the new address goes in, followed by **Continue**. If another STRG account already uses the new address, the dialog says so straight away: *An account with this address already exists.* Otherwise the verification steps follow, proving that you hold both the account and the new address: | Step | What you enter | | --- | --- | | 1 | Only if two-factor authentication is on: the six-digit code from your authenticator app | | 2 | A code emailed to your current address | | 3 | A code emailed to the new address | Once both addresses are verified, **Change address** makes the switch. From then on: - Sign-in codes, invoices and every other email go to the new address. - A notice goes to the old address, saying the address was changed and showing the new one partly masked, so whoever reads the old inbox knows it happened without learning the new one. - Signing in with GitHub keeps working. If you later change your primary address on GitHub, your next GitHub sign-in makes it your account's address too, unless another STRG account already uses it. ## Two-factor authentication Two-factor authentication adds a second thing you have to a sign-in: a code from an authenticator app (TOTP) - 1Password, Google Authenticator, Authy or any other. Even someone who can read your email cannot get into the account without it, which makes it well worth turning on for an account that holds data you care about. While it is on, a six-digit code from the app is asked for: - on every sign-in, whether you sign in with an emailed code or with GitHub - before your address changes - before your account closes Each code is accepted once. If a code was just used, the next one the app shows is the one that works. ### Turning it on 1. Under *Two-factor authentication*, the **Turn on** button opens the dialog. 2. After the security check, **Send code** emails a code to your account's address; it goes into the field, followed by **Verify**. This first step makes sure that only the person who reads the account's email can add an authenticator to it. 3. The dialog shows a QR code to scan with your authenticator app, and the same key as text under *Or enter this key by hand*. 4. The acknowledgement checkbox confirms that you have read what losing the authenticator means. 5. The six-digit code your app shows goes into the last field, and **Turn on** completes it. **Danger:** **There are no recovery codes.** If you lose access to your authenticator, you will not be able to sign in, and STRG support cannot turn two-factor authentication off for you or restore access. An authenticator app that keeps a backup of its codes is the safest choice. The key is shown only while the dialog is open. Closing the dialog without confirming a code leaves two-factor authentication off, so nothing changes until the last step succeeds. ### Turning it off The **Turn off** button under *Two-factor authentication* opens a dialog with two steps. The second asks for the very factor being removed, so nobody can turn it off without your authenticator: | Step | What you enter | | --- | --- | | 1 | A code emailed to your account's address | | 2 | The six-digit code from your authenticator app | Then **Turn off** removes it. Signing in no longer asks for a code from your authenticator app. ## Closing your account When a project has ended and you no longer need STRG, you can close the account yourself, right from this page. **Danger:** **Closing your account cannot be undone.** The **Close account** button under *Danger zone* opens a dialog listing what closing does. Once you have ticked *I understand that closing my account is permanent*, **Continue** checks whether the account can close. An account closes cleanly once it holds nothing and owes nothing, and if something is still in the way, the dialog says what it is: | The dialog says | What it means | | --- | --- | | *Delete all your data, including every bucket, before closing your account.* | Every object and every bucket, in every region, needs to be deleted first. The dialog links to your buckets | | *We could not check every region for buckets. Please try again later.* | We could not confirm that every region is empty just now; a later attempt usually goes through | | *Your account is in its first billing period. You can close it from* a date | The account can close on or after that date - the day your first billing period ends | | *Your account has usage in the current billing period. You can close it from* a date | The account can close on or after that date - the day the current billing period ends | If it can close, two more steps confirm that it is really you: | Step | What you enter | | --- | --- | | 1 | A code emailed to your account's address | | 2 | Only if two-factor authentication is on: the six-digit code from your authenticator app | Then **Close account permanently** closes it. Closing: - stops every access key working and disconnects every agent connected to your account - signs you out everywhere - frees your email address, which can then be used for a new account Usage that is reported after you close is still billed to your card on file. ## Codes and limits These limits keep anyone else from guessing a code or flooding your inbox. Most people never meet them; the table shows what each looks like if you do: | | | | --- | --- | | An emailed code | Expires after 10 minutes. A few wrong entries use it up, and a new one can then be sent | | **Send a new code** | Available a minute after the last code was sent - the button counts down. It runs the security check again | | Too many emailed codes | *too many codes requested - please try again in an hour*, or *please start again* when one step has had too many | | Too many wrong authenticator codes | *Too many wrong codes - please wait 15 minutes.* This applies to sign-in too | | Too many address checks | *Too many address checks - please try again in 30 minutes.* | | A verification left unfinished | Expires: *this verification has expired - please start again* | Every code email names the action it confirms. If one arrives that you did not ask for, someone may be signed in to your account: **Sign out** in the avatar menu signs you out everywhere, and support is glad to help from there. ## Questions We are happy to help at [support@strg.com](mailto:support@strg.com).