Skip to content

Profiles and account security

Profile

Under Settings > Profile, set a display name, homepage, identity color, custom status, avatar, and Jitsi call name when the corresponding server features are enabled. Relay 0.11.3 and later prefer draft/metadata-3 to synchronize supported profile values with IRC users, with draft/metadata-2 as a fallback. Without a compatible metadata capability, the values remain local to Relay. See User metadata.

Password and two-step sign-in

Open Settings > Security & sessions. If asked to authenticate again, sign out and perform a fresh sign-in before changing authentication methods. A remembered session alone may not authorize enrollment.

Enroll an authenticator

  1. Under Authenticator app, enter Current password and choose Set up authenticator. Forced enrollment after password sign-in does not ask for the password again.
  2. Scan the QR code with a TOTP app, or enter the setup key manually.
  3. Enter Six-digit authenticator code and select Verify and enable. Setup/challenge requests expire after five minutes; start again if needed.
  4. Save the eight one-time recovery codes somewhere separate from Relay, then select I saved my recovery codes. They are shown only once.

Enrolling TOTP adds a second step to fresh local password logins even when the instance does not require MFA for everyone. To remove it, supply the current password and an Authenticator or recovery code, then choose Remove authenticator. If instance policy requires a factor, register a security key before removing the required authenticator; Relay refuses removal of the last required authenticator.

Register a passkey or security key

Under Register a new security key, enter a Key name, choose Register security key, and complete the browser/device prompt. Use HTTPS (localhost is allowed for development) and the same Relay hostname when signing in later. Keep another available factor or recovery method before removing a key.

Passkeys can provide passwordless authentication when two-step sign-in is optional, or act as the second step after a password. Registering a key alone does not opt an otherwise optional account into mandatory password-plus-key login; enrolling TOTP does opt local password logins into a second step. OIDC logins follow the identity provider's MFA policy rather than Relay's local challenge.

Recovery email

In Relay 0.11.4, an administrator can enable email password recovery for private accounts with a local password.

  1. Open Settings > Security & sessions > Recovery email.
  2. Enter your email address and current password, then choose Send verification code.
  3. Paste the emailed code into Email verification code and choose Verify email within 15 minutes. If your session is ineligible, sign in again first.

An existing verified address stays active until its replacement is verified. Removing an address requires your current password. Removal or replacement invalidates pending reset links and sends a notice to the previous address.

If you forget your password, choose Forgot password? on the sign-in page and enter your Relay username, not an email address. The response does not reveal whether an eligible account exists. If eligible, your stored verified address receives a single-use link valid for 15 minutes; requesting another replaces it. After resetting, sign in with the new password and your existing second factor. The reset revokes existing sessions; it neither signs you in nor removes MFA. Keep reset links private and secure the mailbox. For SSO-only accounts, use your identity provider's recovery process. Without a verified address or when recovery is disabled, contact the administrator.

Sessions

Review signed-in sessions and revoke any you do not recognize. Remembered sessions can reconnect without repeating MFA when their recorded authentication meets current policy. Enabling required MFA means existing password-only sessions must sign in again on reconnect. Signing out of one browser does not automatically revoke other active sessions.

If you lose your authenticator, use a saved recovery code at the code challenge; each works once. For a lost password, use email recovery if configured. Otherwise, or if all factors are lost, contact the administrator and follow account recovery. A password reset alone does not remove MFA.

Optional TOTP, recovery codes and the required-local-MFA policy described here are included in Relay 0.11.1.