# Account and security

Manage sign-in, two-factor authentication, and connected applications.

## Email sign-in
Create and confirm your email account, then set your password. Use the sign-in page's recovery flow if you forget it. Check spam filtering if a confirmation or reset message does not arrive; request a new message if the old link expires.

Email links are sensitive. Open them yourself and do not share them with support. If a link was consumed by another browser or an email scanner, request a new one and follow the page's guidance.

## Linked GitHub identity
Account settings let you manage linked sign-in methods where available. Linking GitHub is different from installing the company GitHub App. Check the GitHub identity displayed during authorisation if you use several accounts.

## Set up two-factor authentication
1. Open your account's security settings.
2. Add the account to an authenticator app using the displayed setup information.
3. Enter a current code to confirm enrollment.
4. Save the recovery codes in a secure place outside the device you use for authentication.

Treat recovery codes like passwords. A used recovery code cannot be relied on again. If you regenerate codes, replace the old saved copy.

## Recover access
Try an unused recovery code if your authenticator is unavailable. Follow the offered recovery flow if you have lost both. Company-assisted recovery has role restrictions: admins can assist ordinary members, while recovery for an admin requires the owner. Contact support if you cannot complete the offered path.

A company may require two-factor authentication before allowing further access. Removing your authenticator does not bypass that company policy.

## Connected apps
Review **Account → Connected apps** and end connections you no longer need. For the Storybook addon, choose Read only unless you need accept/reject actions. Only connect it to a trusted local Storybook.

## Billing email versus sign-in email
The billing email receives billing communications and optional digests. It is not a substitute for each person's sign-in address. Keep both current and verify changes as requested.