GitBlixt
Docs Navigation

Account & Two-Factor Auth

GitBlixt splits your personal configuration across two pages. Settings (/settings) holds your public profile, two-factor authentication, passkeys, AI keys, access tokens, and SSH keys. Account Settings (/users/settings) handles your sign-in credentials — email, password — plus data export and account deletion.

Editing Your Profile

Go to Settings (/settings). The Profile section lets you set:

  • Avatar — upload a JPG, PNG, GIF, or WebP image (max 2 MB)
  • First name and Last name
  • Display name
  • Bio
  • Company and Location
  • Website — must start with http:// or https://
  • Social profiles — GitHub, X (Twitter), Bluesky, Instagram, Facebook, LinkedIn, and Mastodon. Enter just your username or handle; GitBlixt builds the link

Click Save profile to apply your changes.

Account Settings

Visit Account Settings (/users/settings) to manage how you sign in.

Changing Your Email

Enter a new address and click Change Email. A confirmation link is sent to the new address; the change only takes effect after you click that link. Sensitive changes require you to have authenticated recently.

Changing Your Password

Enter a new password (8–72 characters) and its confirmation, then click Save Password.

Other Actions

  • Export my data — generates a tarball of your profile, issues, MRs, SSH keys, access-token metadata, and git bundles of repos you own. You'll be emailed a download link. Limited to one export per 24 hours
  • Delete my account — marks your account for deletion and logs you out. Your data is permanently removed after 30 days; repository contents you authored stay visible but are attributed to "deleted user"

Two-Factor Authentication (TOTP)

Two-factor authentication adds a one-time code from an authenticator app on top of your password. GitBlixt uses the standard TOTP protocol, compatible with Google Authenticator, Authy, 1Password, and similar apps.

Enabling 2FA

  1. Go to Settings → Two-Factor Authentication and click Enable (this opens /users/totp-setup)
  2. Scan the QR code with your authenticator app. If you can't scan, expand Can't scan? Enter this key manually and type the displayed secret into your app
  3. Enter the 6-digit code your app generates and click Enable two-factor authentication
  4. GitBlixt then shows ten one-time backup codes. Save them somewhere safe — each works once and lets you sign in if you lose your authenticator. Click I've saved my backup codes to finish

Verifying at Login

Once 2FA is enabled, after entering your password you're sent to a verification page (/users/totp-verify). Enter the current 6-digit code from your authenticator app and click Verify. If you don't have your app, click Use a backup code instead and enter one of your saved codes.

Backup Codes

Your first second factor, an authenticator app or a passkey, comes with ten one-time backup codes, shown once with Download .txt and Copy buttons. Turning on an authenticator app always makes a new set. With passkeys only, the verification page offers Use a backup code instead too. They work only on the verification page, never as a password for git or the API. Settings → Two-Factor Authentication shows how many you have left; Regenerate backup codes replaces them (after your current password if you last signed in more than 10 minutes ago) and emails you. They're kept while you have any second factor and removed with the last one.

Lost every second factor? An admin can click Reset two-factor authentication on your account in Admin → Users: it removes your authenticator app, passkeys and backup codes, signs you out and emails you. Only root can reset an admin's.

Disabling 2FA

Return to Settings → Two-Factor Authentication, click Manage, enter a current authenticator or backup code, then click Disable two-factor authentication. You may be asked to log in again first if you haven't recently. This removes your secret, and your remaining backup codes unless you have a passkey. Re-enabling later generates a fresh secret and a new set of backup codes.

When 2FA Is Required

Root can require 2FA of every account in Admin → Settings, once their own account has it. A passkey (see Passkeys below) counts as 2FA too, so an authenticator app or a passkey meets the requirement. Until you have one, signing in takes you to the setup page, where you can set up either, and every other page sends you back there, your personal access tokens and OAuth tokens are refused over the API, the MCP server and git over HTTP, as is your password over git over HTTP, email you send to an Ideas board is rejected, and your Ideas calendar feeds stop serving. Git over SSH keeps working. While it's required, you can't disable TOTP unless you also have a passkey, nor remove your last passkey unless you also have TOTP, but you can move TOTP to a new device from the 2FA page with a current code.

An organization's owners can require it of the organization's members too (see Organizations). A member without 2FA is then held to the same rules everywhere on the instance, not only in that organization, and the setup page names the organizations that require it, each with a Leave button (an organization's only owner can't leave it). Leaving every organization that requires it lifts them. Accounts federated from another instance are never asked.

Passkeys

A passkey signs you in with your fingerprint, face, device screen lock or a security key instead of your password. GitBlixt asks the device to verify you every time, so a passkey is both factors at once: signing in with one skips the 2FA code, and having one counts as two-factor authentication wherever 2FA is required.

Adding a Passkey

  1. Go to Settings → Passkeys, or the 2FA setup page when 2FA is required of you
  2. Optionally name it (for example "MacBook" or "iPhone") and click Add a passkey. If you last signed in more than 10 minutes ago, enter your current password first, or, without a password, log in again
  3. Follow your browser's prompt to create the passkey

You can start adding or removing up to 5 a minute. You're emailed whenever a passkey is added to or removed from your account. If you didn't add it, remove it and change your password. Resetting a forgotten password signs you out everywhere and revokes your access tokens, but keeps your passkeys, since they are your second factor. An account whose email was never confirmed also loses its passkeys, authenticator app and backup codes in that reset, since someone else may have registered it.

Signing In With a Passkey

On the login page, click Sign in with a passkey, or pick your passkey from the suggestions your browser shows in the email field. You stay signed in on that browser. Passkeys work on the website only: the API and git keep using access tokens, SSH keys and passwords as before. Your password keeps working alongside your passkeys.

Removing a Passkey

Click Remove next to it in Settings → Passkeys. If you last signed in more than 10 minutes ago, enter your current password first, or, without a password, log in again. The list shows when each was added and last used. While 2FA is required of you, the last one stays until you set up TOTP or add another.

Your Public Profile

Every user has a public page at https://git.michlp.com/your-username. It shows your avatar, name, bio, company, location, website, and any social links you've filled in, alongside your repositories. Visitors see only your public repositories; on your own profile you also see your private ones, with an Edit profile button that links back to Settings.