Account self-service

The hosted pages where people look after their own account — sessions, details, passkeys, phones and apps — and the password reset and e-mail confirmation flows.

Authio hosts an account portal for every client, in the client’s branding and in English or Brazilian Portuguese. People end sessions they do not recognise, manage their passkeys and phones, and see which apps received their data, without you building a screen or answering a support ticket.

The same hosted pages handle the flows that start from an e-mail: resetting a forgotten password and confirming an e-mail address.

The account pages

Each tab has its own address under the client. Link to them from a My account entry in your app:

Account pagesPlain text

https://authio.api.hyperio.tech/realms/acme/clients/acme-web/account/sessions
https://authio.api.hyperio.tech/realms/acme/clients/acme-web/account/profile
https://authio.api.hyperio.tech/realms/acme/clients/acme-web/account/activity
https://authio.api.hyperio.tech/realms/acme/clients/acme-web/account/passkeys
https://authio.api.hyperio.tech/realms/acme/clients/acme-web/account/authenticator
https://authio.api.hyperio.tech/realms/acme/clients/acme-web/account/applications
https://authio.api.hyperio.tech/realms/acme/clients/acme-web/account/connections

The person must be signed in to the realm in that browser. Otherwise the page asks them to sign in first and open it again from the application.
Add ui_locales=pt-BR or theme=dark to the address to set the language or palette, as on the sign-in screens.
The client’s Portal tab in the console lists every hosted page of the client with its address.
Everything a page does is limited to the signed-in person’s own items: an identifier changed in the address only ever matches something of theirs.

Sessions

The open sessions of the account on this application: which one is the current browser, when and from where each started, and how the person proved who they were. A session that came from single sign-on is tagged and lists the other applications the same sign-in opened; ending it signs that browser out of all of them. End signs out another device, Sign out here this one.

Your details

First name, last name and telephone, with a country selector for the dialling code. The e-mail address is shown but cannot be changed here.

Activity

The 20 most recent sign-in attempts on the account, successful or not, with browser, device, operating system, origin and result. Refusals stand out: one from somewhere the person has never been is worth acting on.

Passkeys

The account’s passkeys with their name, kind of device, whether they are synced, when they were added and last used. Register this device adds one; Remove deletes a lost one. A passkey kept on a single device is flagged, with a suggestion to register a second one. The tab lists passkeys only when the client offers the passkey step. See Passkeys.

Authio app

Where the person pairs a phone with the Authio app at any time, with Show the pairing code and the same QR code the sign-in shows. It lists the paired phones — name, platform, model, when paired and last seen, and whether it can be notified — and removes one after confirmation. Below, the 20 most recent requests sent to the phones and the figures of the last 30 days: approved, denied, unanswered and average answer time, with alerts for denied requests and for requests that never reached a phone.

The tab works only when the client uses the phone: it has the push step, or its approval channel is not e-mail only. Otherwise it says the app is not enabled. See Multi-factor.

Applications

The applications of the realm the person allowed to receive their data, with the scopes each receives, and the versions of terms they accepted. Remove access deletes the consent and ends their sessions in that application; the application asks again the next time it is used, and sessions elsewhere stay open.

Connected accounts

Accounts at other services — GitHub, Google Drive, Slack and others the realm offers — that the person connected so the realm’s applications can act there on their behalf, for personal use or for an organization. They connect, choose the default account per service and disconnect. See Connected accounts.

Password reset

The person asks for a reset
On the sign-in screen, Forgot password? opens Forgot your password?. They type their username and choose Send reset link.
Authio confirms it is them
Following the client’s approval channel: a single-use link sent to the account’s e-mail, or a request in the Authio app. For the app, the screen shows a number to tap and waits; approving requires the phone’s fingerprint, face or screen lock, and the screen then moves on by itself. Send me the link by e-mail instead is always available.
They choose a new password
The reset page lists what the new password needs, written from the realm’s password rules, with a strength meter. It also says when the link expires.
They sign in where they started
The page confirms Password updated and asks the person to go back to the sign-in screen and sign in with the new password. It does not open a sign-in of its own.

Why the e-mailed pages do not sign anyone in

The sign-in your app started is still open in the other tab, holding its request. Pages opened from an e-mail — reset password, confirm e-mail, approve a new address — only confirm and ask the person to return to that tab, so the sign-in completes there and comes back to your app as expected.

The screen answers the same way whether or not the username exists, and whether or not the account has a phone, so it never reveals who has an account.
A denial on the phone changes nothing: the password stays as it is.
The same flow renews an expired password: after the right password, the person lands on the reset request with a notice explaining why.

E-mail confirmation

A new account receives a link to confirm its address and cannot sign in until it is followed (see E-mail confirmation for when this applies).

Following the link shows Email confirmed and asks the person to go back to the sign-in screen and sign in with their account.
An invalid, used or expired link shows a form to ask for a new one. The answer is always that a link was sent, whether or not the address has an account waiting.
A person who tries to sign in before confirming sees Address not confirmed yet with Send the confirmation email again.
An administrator can resend the link from the user’s page in Users.

Next steps

Hosted loginThe sign-in screens and how to brand them.Security policiesPassword rules, lockout and the approval channel.Sessions and SSOSession lifetime, single sign-on and sign-out.