Devices and security

You sign in to pixmoat with your email address and password. This page covers keeping that sign-in safe: your password, the browsers signed in to your account, and what to do if you think someone else is using it.

Everything here is on the Account page. Open the user menu in the top right and select Account.

Reset a forgotten password

1. On the sign-in page, select Forgot password?.
2. Enter your Email address and select Send reset link. You’ll see Check your email, whether or not the address has an account.
3. Open the email “Reset your pixmoat password” and select Reset your password. The link works once and expires after 1 hour.
4. Enter a New password of at least 8 characters, repeat it in Confirm password, and select Reset password.
5. Select Sign in and sign in with the new password.

A reset is a clean start. It signs out every browser, forgets every remembered device and revokes all your personal access tokens. Project access tokens used by CI keep working. Create new personal tokens for your scripts and agents afterwards.

If you see “This reset link has expired or already been used.”, request a new link. Links in pixmoat’s security emails that say “reset your password” open Invalid reset link. Select Request new reset link there and continue from step 2.

You can request up to 10 links in 5 minutes. After that you’ll see “Too many requests. Please wait a moment and try again.”

Change your password

1. On Account, go to Change Password.
2. Enter your Current password, then the New password (at least 8 characters) and Confirm new password.
3. Select Change password. You’ll see “Password changed successfully.”

The browser you’re using stays signed in. Every other browser is signed out and needs the new password. Your personal access tokens keep working. If you think a token leaked too, use Secure account or revoke it.

If the current password is wrong, pixmoat signs you out and shows the sign-in page. Sign in again and retry.

If pixmoat opens Change your password right after you sign in, you’re using a password someone else set for you. Change it to continue.

Review your devices

Account → Security → Recent devices lists the browsers that used your account in the last 180 days. Each row shows the browser and operating system, (This device) for the one you’re using, Active now · Signed in or Remembered browser, and when it was last active.

To sign out a single browser, select Sign out on its row and confirm. That browser needs your password again, and possibly an email code, before it can use pixmoat. You can’t sign out the browser you’re using here. Use Log out in the user menu instead, which signs out only this browser.

A sign-in lasts up to 14 days in a browser.

Confirm a new browser

pixmoat may ask you to confirm a browser it doesn’t recognize. This happens when your account was recently used in several browsers, or after an unusual-activity notice. You’ll see Confirm this browser after your password.

1. Open the email “Your pixmoat sign-in code” and find the six-digit code. It names the browser that asked for it.
2. Enter it in Confirmation code and select Confirm and continue.

The code expires after 10 minutes and allows 5 tries. Resend code sends a new code, twice at most. If you didn’t try to sign in, don’t share the code with anyone. Reset your password instead.

If your account has reached its device limit, you’ll also see Choose a device to sign out. The browser you pick is signed out when you confirm, and this browser takes its place.

What to do if it goes wrong:

Unusual-activity notice

If your account makes changes from several browsers at the same time on several days, pixmoat shows Review your account security at the top of the app. It also emails “Review recent activity on your pixmoat account”. This usually means teammates are sharing one login.

• Review devices opens Account → Security.
• These were my devices clears the notice.
• Not now hides it for seven days.
• Invite teammate, shown to owners and admins, opens the member list. Everyone should have their own login; see Team and roles.

If the pattern continues, the notice changes to Confirm new browsers. From then on, every new browser needs an email code until the pattern stops for 30 days.

If you don’t recognize the browsers, secure your account and reset your password.

Secure your account

Use this if you think someone else has your password or a personal token.

1. On Account, under Security, select Secure account.
2. You’ll see Sign out everywhere else?. Leave Revoke my personal access tokens checked unless you’re sure your tokens are safe. Project and CI tokens aren’t affected.
3. Select Secure account. You’ll see “Other devices have been signed out.”

This browser stays signed in. Every other browser is signed out and removed from Recent devices. pixmoat emails you “Other pixmoat devices were signed out”.

Secure account doesn’t change your password. If someone else knew it, change your password straight away. If a project access token leaked, a project admin has to revoke it in the project’s Settings → Tokens (see Access tokens).