Account settings on Voroa: your name, email, and password

Account settings is where you manage yourself: your name, the email you sign in with, and your password. It is separate from Settings, which manages a workspace — its name, notification email, plan, and members. Your account travels with you across every workspace you belong to; workspace settings apply only to the workspace you are currently in.

Open it from the avatar in the top-right corner of the dashboard, then select Account settings.

Profile

Full name

Your name as it appears on your account. Select Edit, type your name, and select Save. It can be up to 120 characters. If you have not set one, the field reads Not set — nothing breaks, it is simply blank.

Email

The address you sign in with. It is shown here for reference and cannot be changed from this page yet.

Changing the address you sign in with is not a cosmetic edit: it has to be verified before it takes effect, and it interacts with where your invoices are sent and which pending workspace invitations match you. We would rather ship that properly than give you a button that half works. Until then, if you need your sign-in address changed, contact support.

Your workspace’s notification and invoice address is a separate setting and you can change it today — see Workspace settings.

Avatar

Your avatar is generated automatically from your name (or your email, if you have not set a name). It is a coloured circle with your initial, and it always looks the same for your account. There is no image upload.

Password

If you signed up with an email and password

Select Change password, enter your current password, then a new one of at least 8 characters, and save. Your current password is required — this is what stops someone who has walked up to an unlocked screen from taking over the account.

If you signed in with GitHub

Accounts created through GitHub have no password at all, so this section reads Set a password instead, and does not ask for a current one. Setting a password is optional: it simply adds email and password as a second way to sign in, alongside GitHub. Your GitHub sign-in keeps working either way.

If a password is entered wrongly many times

After several wrong passwords for the same email address, Voroa asks your browser to complete a quick, invisible security check before it checks the next one. If the check cannot run, or after a very large number of wrong attempts, Voroa asks you to wait before trying another password, and the wait grows the more attempts there are. It never locks your account: signing in with an email code, GitHub or a passkey always works while you wait, and a browser you have already signed in on with your password keeps its own allowance, so someone else guessing at your email does not slow you down there. The message says “Too many attempts for this email” whether or not an account exists, so it tells nobody whether you have one.

Changing your password keeps you signed in on the device you changed it from, and signs you out everywhere else - every other browser and device has to sign in again with the new password. It also turns off the SSH keys and access tokens you created, because they were issued under the old sign-in; add them again afterwards if you still need them.

Sign-in methods

Other ways to sign in to this account, each shown as Connected or Not connected. The card lists the providers you can use today.

• Connect takes you to the provider to approve, then brings you back to Account settings. The connection is added to the account you are signed in to, even if your account at the provider uses a different email address.
• Disconnect removes that way of signing in. You can still sign in with an email code, or with your password if you have one.

Both ask you to confirm it is you first. We email you whenever a sign-in method is connected, so a connection you did not make does not go unnoticed, and it appears under Security activity.

One case refuses a disconnect: if we cannot send email codes at that moment and the provider is your only other way in - no password, no passkey, no other provider - removing it would lock you out, so the page says so instead. Set a password first, then disconnect.

Disconnecting GitHub here only stops GitHub from signing you in. Repositories you already connected stay connected and keep deploying. If you later give Voroa access to more repositories from GitHub’s own settings, use Connect GitHub in Voroa to link them.

Where you’re signed in

This card lists every browser and device currently signed in to your account: the kind of browser, how it signed in (password, email code or GitHub), when it signed in, and when it was last active. The device you are using right now is marked This device. Addresses are shown shortened, so a screenshot of the page does not reveal where you are.

• Sign out one device - select the sign-out control on its row. That device’s session ends immediately; the next thing it tries to do asks it to sign in again.
• Sign out all other devices - ends every session except the one you are using.

Signing out from the menu on any device also ends that session on our side, not only in the browser. A session also ends on its own after 7 days of no use, and after 30 days at the most.

If you see a device you do not recognise, sign it out, then change your password - that ends every other session and turns off SSH keys and access tokens created before the change.

Security activity

A record of sign-ins and security changes on your account for the last 90 days: successful sign-ins and how they happened, failed password attempts, devices signed out, password changes and resets, and sign-in methods being connected or disconnected. Only you can see it. Failed attempts for an email address that has no Voroa account are not recorded anywhere.

Two-step verification

Asks for a second step - a code from an authenticator app, or a passkey or security key - every time you sign in. How to turn it on, how passkeys work, what recovery codes are for, and what to do if you lose your phone: Two-step verification.

What is not here yet

API keys, authorised applications, and account deletion are not available yet. When they arrive, this guide will cover them. We would rather show you a short page that is entirely real than a long one where most of it does nothing.