![Ringle](assets/ringle-logo.png)

# Account security and sessions

## Purpose
Change your password from Account Settings, turn multi-factor authentication on or off, and review or revoke the devices signed in to your account.

## Prerequisites
- A portal account, signed in.
- Your current password, if you plan to change it.

## Steps

### Step 1

![account-security-and-sessions, step-01](screenshots/account-security-and-sessions/step-01.png)

**Action:** Open Account Settings from the sidebar and click the Security tab.

**What you should see:** The tab shows three cards. Change Password has Current Password, New Password, and Confirm Password fields with a Change Password button. Multi-Factor Authentication has an MFA Status chip (Enabled or Disabled) and an Enable MFA or Disable MFA button. Active Sessions lists each signed-in device.

### Step 2

![account-security-and-sessions, step-01](screenshots/account-security-and-sessions/step-01.png)

**Action:** To change your password, fill in your current password, the new password, and the confirmation. Then click Change Password.

**What you should see:** The fields clear and a confirmation message appears on success. The new password must meet the account password policy: at least 12 characters with uppercase, lowercase, a number, and a special character. The confirmation must match.

### Step 3

![account-security-and-sessions, step-03](screenshots/account-security-and-sessions/step-03.png)

**Action:** To turn on MFA, click Enable MFA on the Multi-Factor Authentication card. Tick the method or methods you want. Click Enable MFA in the dialog.

**What you should see:** The "Enable multi-factor authentication" dialog offers three methods: Email code (needs a verified email address), Text message (SMS) code (needs a verified phone number), and Authenticator app (TOTP). The dialog's Enable MFA button stays disabled until at least one method is ticked. On success, the MFA Status chip flips to Enabled and a confirmation message appears. If you picked the authenticator app, the dialog moves to a "Set up your authenticator app" step. It shows a one-time secret with a copy button. Add the secret to your authenticator app before clicking Done: it is shown only once.

### Step 4

*Screenshot not available (the disable-MFA confirmation only appears once MFA is enabled)*

**Action:** To turn MFA off again, click Disable MFA. Review the confirmation dialog. Then confirm.

**What you should see:** Once MFA is on, the card's button reads Disable MFA. Clicking it opens a confirmation dialog that warns sign-in will no longer ask for a second factor. Confirming flips the MFA Status chip back to Disabled. Cancelling leaves MFA on.

### Step 5

![account-security-and-sessions, step-01](screenshots/account-security-and-sessions/step-01.png)

**Action:** Review the Active Sessions card.

**What you should see:** Each entry shows the device's browser description, its IP address, and when it was last seen. The session you are using now carries a green Current badge.

### Step 6

![account-security-and-sessions, step-06](screenshots/account-security-and-sessions/step-06.png)

**Action:** To end another device's session, click the sign-out icon next to that session. To end everything except the session you are using, click Sign out all other devices at the top of the card.

**What you should see:** A confirmation dialog opens. For a single device it reads "Revoke this session?" and warns the device will be signed out immediately and will need to log in again. For all devices it reads "Sign out all other devices?". After you confirm, the revoked session ends immediately and disappears from the list. Anyone using that device is signed out and must log in again. The sign-out icons and the Sign out all other devices button only appear while another session exists.

## Troubleshooting
- Change Password fails with a current-password error: the current password you typed is wrong. If you cannot remember it, sign out and use the forgot-password flow instead.
- The new password is rejected: check the policy (12 or more characters, uppercase, lowercase, number, special character) and that both new-password fields match.
- A method in the Enable MFA dialog is greyed out: Email code requires a verified email address and SMS code requires a verified phone number. Verify the contact detail first, or use the authenticator app method, which is always available.
- You closed the authenticator setup step without saving the secret: the secret is shown only once. Disable MFA and enable it again to get a fresh one.
- A session you revoked still shows in the list: refresh the page. The list does not always update instantly.
- You revoked your own other device by mistake: nothing is lost permanently. Sign in again on that device.

## Notes
- Route: `/account/security`.
- Source component: `pages/account/AccountPage.jsx` (Security tab implemented in `AccountSecurityTab.jsx`) in the portal app.
- Session revocation and MFA disable both confirm before taking effect. The actions apply immediately once confirmed.
- With MFA enabled, the sign-in flow adds a verification-code step after the password; see the "Logging in, logging out, and MFA" guide.
- The Change Password card is the same operation as the standalone `/change-password` page covered in the "Password reset and recovery" guide.