Account & Security.

Identity, sign-in, devices, one tab.

The Account tab is the only place to change who you are to Playloop and how you prove it. Display name, email, password, connected OAuth providers, two-factor authentication, and every active session on your account live in one scroll, with anchored sub-sections so deep-links land you exactly where you need to be.

Every change that touches sign-in is gated by step-up reverification · Playloop's own password prompt opens in front of the page when the call lands on the server with a session that's too old to authorize a sensitive write. Cancel the modal and the page resumes silently; verify and the original click re-fires automatically.

Top to bottom.

The Account tab renders these sections in order. Skip ahead with the anchors:

1. Studio , workspace defaults applied to new games.
2. Profile , display name, email, Pro-gift status (when active), credits balance.
3. Sign-in & Security (anchor #sign-in-security), connected accounts, password, 2FA, active devices, sign out of every device.
4. API Keys , public tester key + management key with rotate controls, plus the MCP server card (free for every account).
5. Audit log + data export , one-click links to the security audit log and a JSON export of every row attributed to your account.
6. Danger zone , account close with a 14-day undo window.

The #sign-in-security anchor is the canonical deep-link target for any in-product email or banner that wants to push the user to the authentication area, every verification-required email and in-app prompt lands here.

Your data is fenced from other studios.

Cross-tenant isolation is enforced at the database, not just in application code. Every user-scoped table is protected by Row-Level Security policies that scope reads and writes to the authenticated caller. If a bug ever removed an in-code filter, the database would still return zero rows rather than another studio's data, defense in depth, not application discipline alone.

Tables without a direct owner column (insights, session assets, playtest keys, invites, handles) use join-based policies that walk through the parent row, so a query for another studio's rows still resolves to nothing. The full architectural detail is on /security.

Workspace defaults.

Two fields, both used as defaults when you create a new game from /games:

• Studio name. Shown next to your games in dashboards, reports, and exports. Free-form string; renamed studios re-stamp automatically on the next page load.
• Default game engine. Used as the pre-filled engine when creating a new game so you don't pick Unity twenty times in a row. Per-game value still wins, this is just the seed.

Save runs through a server action; no step-up needed (these are workspace defaults, not identity changes).

Who you are to Playloop.

Surfaced in this card:

Two render modes, one rule.

The email field flips between read-only and editable based on whether you have a self-managed sign-in method:

Change-email flow

1. Click Change email. The current address stays visible so you can confirm what you're replacing.
2. Enter the new email. Sanity-validated on the form, then re-validated server-side.
3. Adding the new address is step-up gated. Cancel the modal and the form stays open for retry.
4. A 6-digit code lands at the new address. Enter it in the form. Resend code re-prepares the verification.
5. On successful verification, the new address is promoted to primary, also step-up gated. Cancel here and the new address stays attached as a secondary; you can retry the promote later.
6. The change is recorded in your audit log with the new email. The old address remains attached as a secondary email on your account.

The authentication surface.

Five sub-sections, all rendered by a single client component that hangs its own step-up provider so the custom modal is available to every sensitive write inside. Deep-link target: /settings/account#sign-in-security.

Connected accounts

Lists every OAuth provider linked to your Playloop account. Google is the only provider wired up today; the layout accommodates more without code changes when they ship.

Connect

Click Connect Google, an OAuth round-trip kicks off. Step-up gated. Recorded in your audit log as “OAuth connected” with the provider name.

Disconnect

Click Disconnecton the provider row. Step-up gated. Recorded in your audit log as “OAuth disconnected.”

Self-lockout guard

The Disconnect button refuses to leave you without any sign-in method. The rule:

You can disconnect a provider only if you also have a password set OR at least one other OAuth provider linked. If neither is true, the button is disabled and shows the rule on hover. The same rule is enforced server-side; the client check exists so the UX surfaces the reason before the click instead of after.

Password

Renders as either Set password (OAuth-only users who never set one) or Change password (everyone else). Same form, same step-up gate, different audit kind.

• Minimum length: 8 characters. Confirm input must match. Both checks run before any network call.
• Optional checkbox: "Sign out of all other devices after saving." Defaults to checked.
• Saving is step-up gated. Cancel the step-up modal and the form stays open with your inputs preserved.
• Recorded in your audit log: “password set” the first time, “password changed” afterwards.

Two-factor authentication

Authenticator-app (TOTP), text-message (SMS) codes, plus single-use backup codes. The enrollment flow lives inline on the Security card, no hosted page or external redirect.

Enrollment flow

1. Click Enable authenticator. Step-up gated.
2. The inline panel renders the standard otpauth:// URI as a QR code (rendered client-side, never leaves your browser) plus the bare secret string as a fallback for users who can't scan. The secret has a Copy button.
3. Scan the QR with 1Password, Authy, Google Authenticator, Bitwarden, or any RFC 6238 client. Enter the 6-digit code the app shows.
4. Once the code verifies, TOTP is enrolled and the action is recorded in your audit log.
5. Immediately after verification the first set of backup codes is auto-generated and shown once. There's no opt-out here on purpose, TOTP without backup codes is the fastest way to get locked out of your own account.
6. The codes panel offers Copy all / Download .txt (playloop-backup-codes.txt) / I've saved them. The backup code generation is recorded in your audit log (same row covers initial creation and regeneration).

Disable

Disableon the enrolled row → confirmation prompt → step-up modal → TOTP is removed. Recorded in your audit log as “TOTP disabled.”

Regenerate backup codes

Once TOTP is on, the codes row exposes a Regenerate codesbutton. Confirmation dialog warns that the previous set stops working immediately. Step-up gated; recorded in your audit log as “backup codes regenerated.”

Text message (SMS)

Prefer a texted code? On the Text message (SMS) two-factor row, click Enable SMS, enter your phone number, and confirm the 6-digit code we text you (step-up gated). At sign-in you can then choose Text message code as your second factor. Removetakes it off your account after a confirmation. Recorded in your audit log as “SMS two-factor enabled / disabled.”

SMS codes are available in the US & Canada only. Outside those regions, use the authenticator app, which works anywhere.

Passkeys

Sign in without a password using Touch ID, Face ID, a security key, or your phone. Passkeys are phishing-resistant, and the private key never leaves your device.

Add a passkey

On the Passkeys card, click Add a passkey(step-up gated). Your browser shows its native prompt to create one with your device's biometrics or a security key. The new passkey appears in the list and the action is recorded in your audit log.

Manage

Each passkey lists its name plus when it was added and last used. Use the pencil to rename one so you can tell your devices apart. Remove deletes it after a confirmation (step-up gated). Removing a passkey is safe: your password and other sign-in methods keep working.

Sign in with a passkey

On the sign-in screen choose Sign in with a passkey, then pick the passkey for this site. No email or password required.

Active devices

Every browser or device currently signed into Playloop. Current device pinned to the top, everything else sorted by last-active.

What you see per row

• Device icon, desktop, phone, or tablet.
• Browser name + OS string (Chrome · macOS, etc.).
• Location, city + country when available, else the raw IP, else nothing.
• Relative last-active time: Just now / 3m ago / 2h ago / Yesterday / 4d ago.
• A green This device pill on the row tied to the current session. That row has no revoke button, to sign out of the current device, use the regular sign-out menu in the app shell.

Revoke a session

Every non-current row exposes a Sign out button (red, ghost-style). Click runs through step-up and signs that one session out. The list reloads after success. Recorded in your audit log with the device + browser hints, so you can confirm later which device you kicked out.

Sign out of every device

The nuclear option. Revokes everyactive session including the one you're using right now. Use it if you suspect someone else has access or after recovering from a lost device.

• Step-up is enforced server-side, not just in the UI. A leaked client never reaches the operation without a fresh verification.
• Wipes every active session on your account, then you land on /sign-in.
• Recorded in your audit log with the count of sessions revoked.

Reverification, in Playloop's skin.

Sensitive operations, rotating an API key, saving a BYOK key, changing your password, enrolling TOTP, disconnecting Google, saving a BYOK budget, revoking a session, require your session to have proven itself recently. When the server says the proof is stale, Playloop opens a styled reverification modal right in front of the page.

The BYOK key save and BYOK budget save flows have their own full write-ups (storage, decryption, monthly cap behaviour, cancellation UX) in /docs/ai-provider.

What it covers

Step-up wraps every sensitive write, both identity-provider mutations (password change, TOTP enroll, OAuth connect/disconnect, primary-email change, session revocation) and Playloop server writes (API key rotation, BYOK key save/clear, BYOK budget change). One prompt covers both: if a write lands and the server says your session needs a fresh proof, the modal opens and the original action automatically retries after you verify.

What happens inside the modal

1. Title: Verification required. Single password input, autofocused.
2. Submit verifies your password against the authentication provider.
3. On success the modal closes and the original action fires automatically. Anything else surfaces a friendly error message under the input.
4. Escape or click-outside closes the modal cleanly. The caller decides whether to leave the form open or reset.

Closed allowlist of identity events.

Every sensitive change on the Account tab writes one row to your audit log, validated against a fixed allowlist of events. Clients can't forge entries for other users, and a logging hiccup never blocks the operation you just completed. Surfaced in-app via the audit log panel in Settings.

The table below covers the identityentries this page's sections fire. The full audit-log surface (BYOK key saves, BYOK budget changes, notification toggles, studio profile edits, session events, system events) lives in /docs/notifications · Audit log.

Programmatic access + self-service forensics.

Below Sign-in & Security the Account tab surfaces three entry points that don't require step-up to view, only to act:

Storage usage, Managed AI quota, and Daily AI cost meters live on /settings/usage and the Billing tab , not here. The Account tab is identity + access; the meters are spend.

Account close.

Pinned to the bottom of the Account tab, explicitly not at the page footer, so destructive identity actions sit next to the rest of your identity surface.

• Closing schedules a delete with a 14-day undo window. During the window the account is soft-deleted: you can sign back in to undo, the data is still on disk.
• After 14 days an automated daily cleanup permanently deletes the user, every game they own, every session, transcript, insight, summary, and uploaded asset. No recovery after that.
• Active Pro gifts are surfaced in the close dialog so you can see what you'd be walking away from.