Account recovery#

What happens when you reset your password — every credential it revokes, the one kind it deliberately keeps, and how to recover an account you think has been taken over.

Resetting your password#

If you can't sign in, request a reset link from the forgot-password page. The link is sent to your account's email address, is valid for one hour, and works once — requesting a new link invalidates the previous one.

A reset is the strong door. It assumes the worst — that someone else had your password — and revokes everything that password could reach, not just the password itself.

What a reset revokes#

The moment the reset completes:

• Every session is signed out. Each browser and device must sign in again with the new password.
• Every personal access token is revoked — including tokens minted by OAuth applications you authorized, which are ordinary tokens with a 30-day expiry. Git over HTTPS, the API, the CLI and MCP clients using one will refuse until you mint a new token under Settings → Access tokens.
• Every registry token is revoked. Container logins using one must run rickub login (or docker login) again, and short-lived registry credentials already issued from a revoked token stop working too.

The confirmation page spells this out, and the reset form warns you before you commit it — the revocations are the point, not a side effect.

SSH keys are kept — review them#

SSH keys are not revoked by a password reset. Deleting them would lock your own laptop out of git, and the reset can't tell your key from one an attacker added — only you can.

So the confirmation page lists every key on the account — its name, its SHA256:… fingerprint, and when it was added — at the exact moment you should be questioning them. If you don't recognise a key, remove it under Settings → SSH keys after signing in. An unrecognized key that you leave in place keeps full git read/write over SSH.

Changing your password while signed in#

The voluntary change under Settings → Password is the different door, and it does less on purpose: you're holding the current password, so there's no takeover to undo. It signs out your sessions on other devices (the device you're on stays signed in) and leaves tokens and SSH keys alone.

If you have any reason to think someone else has access to your account, don't use the settings form — reset by email instead, which revokes every token.

After a recovery: the checklist#

A reset that revoked everything leaves you with homework. Back in, re-arm what you use:

• Mint a new personal access token under Settings → Access tokens and update your git credential helper, CLI and MCP clients.
• Re-run your registry login (rickub login) — once per machine that pushes or pulls images.
• Review the SSH keys listed on the confirmation page — remove anything you don't recognise under Settings → SSH keys.
• Check Settings → Sessions — sign out anything you can't account for. Tokens minted by OAuth applications you authorized were revoked with the rest; re-authorize an application you still use.