Account security

Your account's security controls are available from Settings. Organization policy can impose additional requirements. API credentials and repository permissions are separate: a credential cannot grant access your account does not have.

Set up sign-in protection

Open Security settings to manage your password, passkeys, and two-factor authentication. For two-factor authentication, complete the authenticator setup and store the recovery codes somewhere you can reach if you lose your device. Keep them out of repositories, issue comments, and shared screenshots.

Give passkeys recognizable names so you can remove the correct device later. If your organization requires a second factor, follow the policy prompts before accessing its resources.

Review sessions and tokens

Use the sessions and personal access token sections of Settings to review access you no longer need. Revoke credentials for lost devices, abandoned integrations, or unexpected activity. Removing a local file containing a token does not revoke the token on the server.

Create a separate token for each integration and choose the smallest available scopes that cover its work. Set an expiry when the token form offers one. Store the token in your integration's secret storage; do not put it in a URL or commit it to source.

The API and authentication guide explains bearer credentials. The CLI offers gbb auth status to inspect its configured account without printing the credential.

Connect Git

Use the repository's displayed clone address. For SSH, add your public key in Settings and keep the private key on your device. For HTTPS, follow the credential method offered by your deployment or the CLI's gbb auth setup-git prompts. An account passkey is not an SSH key or an API bearer token.

Recover access

Follow the sign-in page's password recovery flow when offered. If recovery mail does not arrive, check the destination and spam folder, then contact your deployment administrator. Do not share reset URLs, one-time codes, recovery codes, or token values in a support request.

If a factor or organization policy prevents access, use the available recovery path or ask the administrator for the approved account-recovery procedure. See Troubleshooting for safe diagnostic details.