Sign-in methods and emailed links

There are several ways into an EmailConnect account. This page lists them, says which of them two-factor authentication covers, and explains the setting that switches off the links we send by email.

Ways to sign in

Email and password
A sign-in link sent to your email address ("magic link"). The link is valid for 10 minutes
Google or GitHub
A passkey — see Passkeys

A forgotten password is reset through a link sent to your email address. Using that link signs you out on every device.

An account created with a sign-in link, Google or GitHub has no password yet. To set one, go to Settings → Profile and choose Set password: we email you a link, and the password is set from that link.

What two-factor authentication covers

Two-factor authentication (an authenticator app, with backup codes) is switched on under Settings → Profile → Account & security. Once it is on, you are asked for a code after signing in with your password.

It is not asked for after the other methods. A sign-in link, a Google or GitHub sign-in and a passkey each sign you in without the authenticator code. The password-reset link also arrives by email. In practice this means that, by default, anyone who can read your mailbox can use an emailed link to get into the account, even with two-factor authentication enabled.

If that matters for your account, switch the emailed links off.

Switching off emailed sign-in and reset links

Under Settings → Profile → Account & security you will find Emailed sign-in and reset links. It shows Allowed by default. Choose Switch off to change that.

Before you can switch it off

The account needs both of these first:

a password, and
two-factor authentication enabled.

You are also asked for your current password to confirm the change.

What changes while it is off

No sign-in link is sent for the account. The sign-in page answers the same way as before, but no email arrives.
No password-reset link is sent either.
Links already in your mailbox stop working when you switch off.
Google and GitHub sign-in are refused, both for a provider you had linked earlier and for linking a new one. A linked provider is not removed: it works again if you allow emailed links again.
Your other sessions are ended when you switch off. Other browsers and devices have to sign in again; the one you are using stays signed in.
Two-factor authentication cannot be disabled, and the password cannot be removed, while emailed links are off.

You then sign in with your password and authenticator code, or with a passkey.

Getting back in if something is lost

Read this before you switch off, because the usual safety net (a link to your mailbox) is exactly what you are removing.

Lost your authenticator? Sign in with your password and one of your backup codes. Keep the codes somewhere safe; without them a lost authenticator locks you out.
Forgot your password? It cannot be reset by email. If you have a passkey, sign in with it. If you do not, there is no way back in that you can use yourself: you will need to contact support@emailconnect.eu.

Registering a passkey before you switch emailed links off gives you a second way in that does not depend on remembering the password.

Allowing emailed links again

Choose Allow again in the same place and enter your current password. Sign-in links, password-reset links and Google or GitHub sign-in work as before from that moment.

API keys are separate

None of this affects API keys. They keep working as they did, and the setting itself can only be changed while signed in to the dashboard, not with an API key.