# Sign-in and security

You sign in to the Spectate dashboard with your email address and a password, or with a GitHub, Google or Microsoft account. You must verify your email address before you can use the dashboard. Two-factor authentication adds a code from an authenticator app to every sign-in.

## Sign in

- **Email and password**: type your **Email** and **Password**, then select **Sign in**. Select **Keep me signed in** to stay signed in on this browser.
- **GitHub, Google or Microsoft**: select the button of the provider above the email form.

If you forgot your password, select **Forgot password?** on the sign-in page. Spectate sends a reset link that is valid for 60 minutes.

## Verify your email address

Spectate sends alerts, incident updates and account emails only to a verified address. Until you verify, you can sign in and manage your account, but you cannot use the rest of the dashboard.

1. Open the email from Spectate.
2. Select the verification link. The link is valid for 24 hours.

The **Verify your email** page continues on its own when you verify. On that page you can also send the email again, change the address, or log out. To accept a [team invite](/account/members#accept-an-invite), you also need a verified address.

Some sign-in providers verify the address for you:

| Provider | Verifies your email |
|---|---|
| GitHub | Yes |
| Google | Yes, if Google marks the address as verified |
| Microsoft | No. Spectate sends a verification email. |

An existing account also becomes verified when you sign in with GitHub or Google with the same email address.

## Sign in with GitHub, Google or Microsoft

If no Spectate account has the provider's email address, Spectate creates an account and a team for you.

If a Spectate account already uses that email address, the provider cannot create a second account. Connect the provider to your existing account first:

1. Sign in with your email and password.
2. Go to **Account → Security**.
3. Under **Sign-in providers**, select **Connect** next to the provider.
4. Sign in at the provider.

To stop using a provider, select **Disconnect** next to it. An account that you created with a provider has a random password. To set your own password, use **Forgot password?** on the sign-in page.

## Two-factor authentication

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app every time you sign in. It also applies when you sign in with GitHub, Google or Microsoft.

### Turn on two-factor authentication

1. Go to **Account → Security**.
2. Under **Two-factor authentication**, select **Enable 2FA**.
3. Type your **Current password** and select **Continue**.
4. Scan the QR code with your authenticator app.
5. Type the 6-digit code from the app.
6. Select **Confirm and enable**.
7. Save the recovery codes. Select **Download**, or copy them to a password manager.

### Recovery codes

A recovery code lets you sign in if you lose your authenticator app. Each code works once. On the sign-in page, select **Use a recovery code instead**, then type a code.

To see your codes or make new ones, go to **Account → Security** and select **Recovery codes**. Select **Regenerate** to replace all codes. The old codes stop working.

### Turn off two-factor authentication

1. Go to **Account → Security**.
2. Under **Two-factor authentication**, select **Disable**.
3. Type your **Current password**.
4. Select **Disable 2FA**.

## Change your password or email address

- **Password**: go to **Account → Security**. Under **Password**, type your **Current password** and the new password twice. Select **Change password**.
- **Email address**: go to **Account → Profile**. Change **Email address** and select **Save profile**. You must verify the new address. Spectate also sends a notice to the old address.

## Security emails

Spectate sends you an email when one of these things happens to your account:

- Your email address changes. Spectate sends this email to the old address.
- Your password changes or is reset.
- Two-factor authentication is turned on or off.
- Your recovery codes are regenerated.
- A sign-in provider is connected or disconnected.

If you did not make the change, reset your password and contact [help@spectate.net](mailto:help@spectate.net).

## Sessions

**Account → Sessions** shows the browser that you use now. Select **Sign out** to end this session.

## AI assistants

**Account → AI assistants** lists the AI assistants that you connected to Spectate through the [MCP server](/developers/mcp). You can disconnect each one there.

## Related

- [Data and privacy](/account/data-and-privacy): how to delete your account.
- [Teams and roles](/account/teams-and-roles): what you can do in each team.