Signing in and keeping your account safe

You open your installation's address in a browser. The page passes once through the Player One sign-in and your chats open. You typed no password, because the sign-in you made this morning was still live.

You have one Player One account, and the account site and every installation you belong to sign you in through it. This page covers making the account, every way of signing in, the second step that protects it, and how to end a sign-in you no longer want.

The account site is at dashboard.1p.dev, which is where Login on 1p.dev goes. It asks for no password itself. It sends you to the Player One sign-in page at auth.1p.dev and brings you back when you are in.

Your installation works the same way. Open its address with no sign-in in that browser and it leaves at once for the same page, which names the installation ("Sign in to your installation", with its address under it). A hosted installation keeps no password of its own. One you run yourself, outside the Player One cloud, does: it keeps its own username and password page, and the rest of this page about the Player One sign-in does not apply to it.

The pages sit at the root of the sign-in address: Sign in (/sign-in), Create account (/sign-up), Forgot password (/forgot-password) and the page that sets the new one (/reset-password). Your account page, once you are in, is under /account.

Create an account

You choose Create account, type your email address, and an email brings a six-digit code. You type it, give your name and a password, and you are in.

Select Create account under the sign-in form, or Continue with Google.
Type your email address, pass the short human check if one appears, and select Send code.
Type the six-digit code from the email. It is valid for 15 minutes and submits itself on the last digit. Send a new code replaces it, and Use a different email starts again.
Type your name and choose a password of at least eight characters, with a number and a special character. Select Create account.
Choose how to protect the account, or select Not now. Protect your account below says what the choices are.

Nothing exists until the code is accepted, so a mistyped address leaves no half-made account behind. If the address already has an account, no code arrives: an email says "You already have an account" and links to sign-in and to a password reset. The page never says which of the two happened.

A new account has no organisation, plan or installation yet. The account site opens on No organization yet with a Create organization button, and Your account and plan takes it from there.

If the page says "Sign-up is not available", new accounts are closed for now and the sign-in page shows no Create account link. An invitation still works. Someone who runs an organisation invites you by email, the link works for seven days, and you type your name, choose a password and go on to the account site signed in.

Type your email address and password and select Sign In. Forgot password? sits beside the password box. Above the form there can be a passkey button and a Google button, with "or use your password" under them. If two-factor authentication is on, a second step follows.

If an administrator created your account with a password of their own choosing, the first sign-in asks you to choose your own.

Continue with Google

Continue with Google is on both the sign-in and the sign-up page, and does the same on each: it signs you in if the account exists and makes one if it does not. Google shares only your identifier, email address and name, and Player One reaches nothing else in your Google account.

A new account, while sign-up is open. Google must vouch for the address, which it does for Gmail addresses and Google Workspace domains. The account has no password, takes its name from Google, and offers Protect your account as after any sign-up.
An account that exists. If Google vouches for its address, Google is linked to it and Player One emails you to say so. Otherwise nothing is linked, and the page tells you to sign in with your password and link Google in your account settings, or to create an account with an email code.
A second step still applies. Google does not skip it.

The Sign-in methods section of your account page, shown where Google sign-in is on, has Link and Unlink. It will not unlink the last way into the account: set a password or add a passkey first. An account made with Google has no password until you choose Set a password, which takes you through the forgot-password steps below.

Passkeys

A passkey signs you in with your fingerprint, face or screen lock instead of a password. It is a sign-in on its own: no password, and no code after it.

Open your account page (/account/settings) and find Passkeys in the Security section.
Select Add, name it ("MacBook", "iPhone", "YubiKey"), and select Create passkey. Your device asks you to confirm.

The passkey stays on that device, or in your password manager if it syncs. On the sign-in page, select Sign in with a passkey, or click into the email box and pick one from your browser's suggestions. A browser without passkey support shows no button. You can rename or remove a passkey from the list. With a second step on, adding or removing one asks you to confirm with that step first.

Protect your account

Right after you create an account, and after a password sign-in until you decide, Protect your account offers a second step, so that a password alone is not enough. It offers up to three choices:

Telegram, marked Recommended. You pick a number in the Player One bot to confirm each sign-in, with nothing to type. It is offered only while the bot is available and you have not connected it.
Passkey, in a browser that supports them.
Authenticator app. Scan the QR code, or type the key shown, then type the six-digit code the app shows.

Not now ends the offer for good. Leaving the page without choosing does not: your next password sign-in offers it again. A passkey counts as a second step, so adding one also ends the offer. Until you have a second step, the account site shows a Protect your account banner with a Set up button that opens the Security section.

When a second step is on, sign-in asks for it after your password or Google. The method you used last comes first, and Use another method lists the rest.

Authenticator app. Type the six-digit code. It submits itself on the last digit.
Telegram. The page shows a number. Pick the same number in the bot. After 30 seconds Send a new message appears.
Recovery code. Type one of your saved codes, in the form XXXXX-XXXXX.
A passkey also works from there, with Sign in with a passkey instead.

Recovery codes

Turning two-factor authentication on shows ten recovery codes, once. Copy or download them and keep them apart from your phone. Each signs you in once, in place of your app.

When two or fewer are left, the sign-in that used one tells you, and the Security section says how many remain. Generate new confirms with your second step, and the earlier codes stop working. A sign-in made with a recovery code cannot make new ones.

If you lose your phone

Sign in with a recovery code or a passkey. In that sign-in, Security > Authenticator app > Turn off needs no code. Turn it on again with the new app and you get new recovery codes. Until you do, the account is on a password alone, and Player One emails you when two-factor authentication goes off.

Telegram

The Telegram section of your account page appears only while the Player One bot is available. Connect shows a QR code, or an Open Telegram button on a phone. Open the bot and press Start, and the page then shows a number to pick in the bot. The link works once, for ten minutes. If your authenticator app is already on, the page asks for a code from it first. Connecting turns on confirming sign-ins and copies of your security notices, and each can be turned off on its own.

Security notices always reach you by email. With Telegram connected they are copied there, with a Not me button that ends the sign-in the notice is about. Disconnect stops the bot writing to you. If Telegram was your only second step, you then need a recovery code or a passkey to sign in until you turn on the app or connect again.

Forgot your password

On the sign-in page, select Forgot password?.
Type your email address, pass the human check, and select Send reset link.
Open the email and follow the link. It works once, within an hour.
Type the new password twice and select Set new password.

The page says "If an account exists for" your address and never says whether one does. Resetting signs you out everywhere else. If the link has expired, start again from step 1. If it arrives cut short, the page offers Send a new link.

Change your password, name or picture

Open your account page (/account/settings). From the account site, it is Manage account in the menu at the foot of the sidebar.

Section	What you do there
Your name and picture	The pencil beside your name edits it. The picture comes from Gravatar, and selecting it takes you there to add or change it.
Security	Change the password, manage passkeys, turn the authenticator app on or off, and Generate new recovery codes.
Sign-in methods	Link or unlink Google, where it is on.
Telegram	Connect the bot, confirm sign-ins in it, mute copies of notices, where the bot is available.
Devices	Every browser signed in to your account.
Player One installations	Each of your installations, with Sign out everywhere.
Applications with access	Anything else signed in to your account, with Remove access.
API tokens	A pointer to Developer settings.

Change asks for your current password, then the new one twice. Your other sessions are signed out when it changes. Your email address is shown on the page but not editable there. To use a different one, contact support.

Sessions and signing out

The account page's Devices section lists each browser signed in to your account: its name, address, when it was last seen and how you signed in. Your own is marked This device.

Sign out on a row ends that browser, with everything signed in from it. It notices within a few minutes.
Sign out of all other devices keeps only the one you are using.
Sign out everywhere, on an installation's row, signs you out of that installation on every device. You stay a member and can sign in again.
Remove access does the same for another application.

How long a sign-in lasts depends on where you are:

The account site and the Player One sign-in page keep you in for 14 days after you last used them, even if you close the browser.
An installation keeps a tab you are using signed in, however long you work. A browser nobody has used for a day asks you to sign in again. Your Player One sign-in is usually still live, so that is a quick pass through the sign-in page with nothing to type. A dropped connection, or an update or restart of your installation, does not sign you out.
If your access is withdrawn, such as being removed from the organisation, an installation you were already in keeps you for at most an hour more.

To sign out, use Log out: in the account site's menu, and in an installation's account menu at the foot of the sidebar. Logging out of an installation also ends your Player One sign-in in that browser, so the next sign-in asks for your password. Always do it on a shared computer.

On your installation

Each browser you sign in from appears on Admin > Devices (/admin/devices), and it pairs by itself: the Player One sign-in is the approval. Here Sign out this browser signs out the one you are using, Forget removes a browser you no longer use, Revoke bans one for good, and Revoke all others revokes every device but the browser you are using. Forget stale devices clears everything not seen for 14 days.

That list is about what holds a credential for this installation, and your account page's Devices is about your account's sign-ins. They are two lists. A computer set up with Sidekick pairs through Sign in with browser, which opens your installation's sign-in in your normal browser: Connect your computer has the steps. Your installation describes the rest of the Admin area.

API tokens

Scripts and tools that call the Player One platform on your behalf use an API token. They are made in Developer settings (/developer), in the same menu as Manage account, and not on your account page.

Select New token, name it, choose who owns it (you, or one of your organisations), and set what it may do in each area: Read, Write or, where offered, Critical. It expires in 30 days, 90 days, 180 days or a year. The token is shown once, so copy it then. Send it as Authorization: Bearer followed by the token. A week before it expires you get an email, and Revoke ends it at any time.

These tokens are different from the keys on Admin > API keys (/admin/api-keys), which let your own apps call your installation's models: Use Player One from your own apps covers those.

What you see	What it means
"Invalid email or password."	One of them is wrong. Try again, or use Forgot password?.
"Too many failed attempts to sign in to this account. Try again in 15 minutes."	Ten wrong attempts in a row closed sign-in to that account. The message counts down. A passkey is closed too.
"Too many attempts. Try again in a few minutes."	Too many requests came from your address. Wait.
"That sign-in took too long. Start again."	The second step waited too long. Select Back to sign in and start again.
"Signing in with a passkey did not work." or the same for Google	Try again, or use your password. Other Google messages tell you what to do next.
"Your Player One account has no access to this instance"	You signed in, but you are not a member of that installation. Select Sign in with another account, or ask whoever runs it to add you.
"Sign-in is temporarily unavailable"	The installation cannot reach Player One right now. It keeps checking, and the button works as soon as it can.
"The sign-in took too long or was started in another browser."	Start again from the installation's address.
"Sign in keeps coming back here."	Something is wrong on the server. Try again in a moment.

If you cannot pass the second step, use a recovery code or a passkey from Use another method. With neither, contact support.

Where next

Your account and plan covers installations, plans and billing. Back up and move your data covers taking your work with you. Troubleshooting has more on being signed out of an installation.