Auth Your Agent

Your account#

Change your display name#

Account → Profile → Name, then Save. Sites that you allowed to see your name get the new one with the agent's next pass.

Sign-in methods#

  • Email and password. Always available.
  • Passkey. On the sign-in screen, choose Passkey and enter your email. Your phone asks for your fingerprint or face.
  • Google or Microsoft. Shown on the sign-in screen only once the service has them switched on.

Staying signed in lasts 30 days on each device unless you sign out.

Phone number#

Account → Phone number lets you add and verify a mobile number with a text-message code. It is used for one thing only: account recovery. It is not a second sign-in factor, and it is never shared with sites unless you approve sharing it.

Your devices#

Account → Devices that get requests lists every phone and browser that receives approval requests. Remove one you no longer use, or one you don't recognise; it stops receiving requests immediately.

Passkeys are listed separately from notification devices. Removing a device does not delete its passkey from your phone.

Activity history#

The Activity tab shows everything that happened on your account, newest first: sign-ins, approvals, denials, revocations, new agents and new devices. You can filter it by agent or by site, and Show older loads more.

Each entry shows the time, what happened, and the network address it came from where that applies.

Download your data#

Account → Your data → Download my data gives you one file (JSON) with everything Auth Your Agent holds about you: your profile, agents, site access, devices and full history. Your password, passkeys and recovery codes are not included in readable form, because we don't store them in readable form.

Delete your account#

Account → Your data → Delete account. You type your email, and your password if you have one, to confirm.

What happens immediately:

  • every agent you own is blocked on every site
  • your passkeys, devices, sessions and recovery codes are deleted
  • your name, email and phone number are erased

What is kept: a record that events happened, without your personal details and without network addresses. Sites need this so that revoked access stays revoked.

This can't be undone. If you want your data first, download it before deleting.