Signing In and Account Recovery

This guide covers getting into your account and staying in it: passwords, forgotten passwords, a lost second factor, and what happens to your sessions when credentials change.

Enrolling your authenticator for the first time, reviewing active sessions day to day, managing team members and roles, and creating API keys are covered in Team, Roles, API Keys, and Account Security. This guide does not repeat them.

None of the surfaces below require a permission scope. They act on your own account, so every signed-in user can reach them regardless of role.

Signing In

Sign in at /login with your email and password, or with Google if your account was created that way. WARP then asks for your second factor before the session can do anything useful.

Two-factor authentication is mandatory. A session that has signed in but not yet verified a code is treated as unverified: most requests are refused with MFA_REQUIRED until you complete verification at /settings/mfa/verify.

After 10 failed sign-in attempts the account locks for 15 minutes and returns ACCOUNT_LOCKED. The lock clears on its own; there is nothing to reset.

Changing Your Password While Signed In

Go to Settings → Password (/settings/password).

You will need your current password, a new password of at least 12 characters, and a recent authenticator code. The change is a single request to POST /v1/auth/password/change.

What happens on success:

• Your password is replaced.
• Every other active session is signed out. The session you are using stays signed in, so you are not locked out of the page you are on.
• A confirmation email goes to the address on your account.

Error codes you may see:

• INVALID_CREDENTIALS — the current password you entered is wrong.
• WEAK_PASSWORD — the new password is shorter than 12 characters.
• PASSWORD_NOT_SET — the account signs in with Google and has no password to change.
• STEP_UP_REQUIRED — your second-factor verification has gone stale. See "Step-Up Verification" below.

Note that changing your password signs out portal sessions only. API keys and any applications you have authorized keep working. Revoke those separately if that is what you intended.

Forgotten Password

Start at /forgot-password and enter your email. WARP always responds the same way whether or not the address is known, so a stranger cannot use the form to discover who has an account. If the address is on file, a reset link is emailed. The link is valid for one hour and can be used once.

The link opens /reset-password. Completing the reset requires three things at the same time:

1. The token from the email.
2. A new password of at least 12 characters.
3. A current code from your authenticator.

That third requirement is deliberate: possession of the reset email alone is not enough to take over an account. If you have lost your authenticator as well, the reset cannot complete — the request returns TOTP_REQUIRED. Recover your second factor first, using the path in the next section, then reset the password.

On success, all of your sessions are revoked, including any you had open elsewhere, and you sign in again with the new password. A confirmation email is sent.

Error codes on reset:

• INVALID_TOKEN — the link has expired, was already used, or is not valid.
• WEAK_PASSWORD — the new password is shorter than 12 characters.
• MFA_INVALID — the authenticator code was wrong or had already rolled over. Wait for the next code and retry.
• TOTP_REQUIRED — the account has no active authenticator.

Lost Authenticator

If you still have a backup code, use it. Enter it instead of a six-digit code at /settings/mfa/verify. Each backup code works once. After signing in with one, generate a fresh set from Settings → MFA (/settings/mfa).

If your authenticator and your backup codes are both gone, use email recovery at /settings/mfa/recover. You must already be signed in to reach it — recovery re-establishes your second factor, it does not replace your first one.

The flow:

1. Request a code. WARP emails a six-digit code to the address on your account. It expires in 10 minutes, and requests are rate-limited.
2. Enter the code.

On success WARP revokes every authenticator and every remaining backup code on the account, emails you a notification, and immediately starts a fresh enrollment — the same one you would run from /settings/mfa/enroll. Scan the new secret and confirm it at /settings/mfa/verify, which issues a new set of backup codes. Save them somewhere you will still have access to if you lose your phone.

If the email address on the account is no longer reachable, this path cannot help you. Contact support.

Step-Up Verification

Sensitive changes require a recent second-factor verification, not merely a signed-in session. If your last verification is older than the step-up window, the request is refused with 403 STEP_UP_REQUIRED and the message "Re-verify 2FA to continue", even though you are still signed in and nothing is wrong with your account.

The portal handles this by prompting for a code and retrying; enter a current code and the action proceeds. Nothing is lost.

Actions behind step-up include changing your password, revoking a session, regenerating backup codes, removing an authenticator, and creating, rotating, or revoking API keys.

API keys and authorized applications are treated differently: for them, possession of the credential plus the permissions it carries is the check, so there is no code to re-enter. Key management itself is not reachable with a key, which is why that exemption does not weaken anything.

Your Other Sessions

Settings → Sessions (/settings/sessions) lists every active sign-in for your user, flags the one you are using, and shows when each was created, when it was last active, and the address and browser it started from. GET /v1/me/sessions returns the same list.

Revoke any session you do not recognize with DELETE /v1/me/sessions/{id}, or with the button on the page. Revoking requires step-up. The page also offers "Sign out of all other sessions", which revokes every session except the one you are using.

Summary of what clears sessions:

Action	Effect on sessions
Change password while signed in	All sessions except your current one
Complete a password reset	All sessions, including yours — sign in again
Recover a lost second factor	Sessions are kept; authenticators and backup codes are revoked
Revoke one session	That session only
POST /v1/auth/logout-all	All sessions including yours; requires your password in the request

Sessions expire on their own after 24 hours of inactivity, and in all cases 14 days after they were created.

If You Are Locked Out

1. If you know your password but not your code, use a backup code. If you have none left, use email recovery at /settings/mfa/recover.
2. If you know your code but not your password, use /forgot-password.
3. If you have neither, recover your second factor first — the password reset will not complete without a current code.
4. If the email on the account is unreachable, or a reset email never arrives, contact support. No one can complete these flows on your behalf without it.