Account

Account (/account) is where a signed-in person manages their own identity and preferences. It is reached from your name in the sidebar footer, and from nowhere else - it belongs to a person, not to a tenant, which is why it sits outside both Settings and the Admin Console.

Any authenticated user reaches it. There is no permission on it.

It is one page with five sections rather than a list of entries: they share no state, and three clicks for two controls and a read-only block is worse than scrolling.

Profile

Your name and email address, read-only. Both come from the account itself; changing them is an administrative action under Platform members.

Password

Change the password for the current account, through the authenticated POST /api/me/password endpoint.

Provide the current password, a new password, and confirmation. The new password must be at least eight characters and cannot be the same as the existing one.

Two cases do not ask for the current password:

• an account in a forced password-change flow - after a successful change it returns to the panel;
• an OAuth-only account adding password credentials for the first time, where the section reads “set a password” rather than “change” it.

If you cannot sign in at all, use the self-service reset from the login page instead.

Two-factor authentication

Managed services. Available with Polyant managed services.

Enrol an authenticator app, or remove an existing factor. This section is where a mandate is satisfied: an account that must hold a second factor is admitted to the panel and sent here rather than being locked out.

See Authentication for enrolment, recovery codes, and what a mandate does.

Personal API tokens

Managed services. Available with Polyant managed services.

Issue a token that calls the management API as you, from a script, with no browser. It follows your live permissions rather than carrying a set of its own, so it stops working when your access does - and it can be restricted to less than you can do, so a leak of the script is not a leak of the account.

It sits here, beside the password and the second factor, because it is the third way into this account. Revoking is immediate.

See Personal API tokens for what a token can never do - change a credential, start impersonation, or skip a two-factor mandate - for the opt-in that lets a Platform Admin’s token act as one for up to 24 hours, and for why an automation should hold a management API key instead.

Preferences

Language and theme. Both are stored in the browser, so they follow the device rather than the account.

The first-access guidance works the other way: what you have finished, skipped or dismissed of the guided setup and the tours is stored on your account, so it follows you across devices. It has no control on this page; the Help menu in the header reopens it.

What this page is not

Managing your own account grants nothing over anyone else’s. Sign-in accounts across the installation are administered from Platform members; organization membership and workspace roles from Members and roles.