Account and organization settings

Settings come in two scopes. Your account belongs to you and follows you into every organization you join. An organization has its own name, address and members, and only its admins can change them.

Your account

Open your account from the menu under your name at the bottom of the sidebar (Account settings), or from Settings, under Account. It lives at /account and has five tabs: Profile, Password & sign-in, Sessions, Connected apps and Email notifications.

Profile

• Avatar. Upload a PNG, JPEG, WebP or GIF of up to 2 MB. Without one, Unhandled shows your initials.
• Full name. Shown in member lists, assignee pickers and comments.
• Time zone. Timestamps across the app are shown in this zone. Leave it empty to use your browser's zone.
• Appearance. Dark, light or system. The choice is saved to your account, so a new browser picks it up the first time you sign in. The theme switch in the account menu changes the same setting.

Email address

A new account gets a verification link at its email address. The link only works while you are signed in to that account: opened in a signed-out browser, it asks you to sign in first and then verifies the address. Until you verify, the profile tab shows a notice with Send a new link, and the account cannot add a passkey, connect GitHub, invite people to an organization or accept an invitation from the dashboard. Signing in with GitHub under the same email is refused instead of joining this account. Accounts that existed before verification was introduced count as verified, as do accounts created through GitHub and accounts that confirmed an email change, reset their password by email or accepted an emailed invitation link.

These rules stop someone who registers your address before you do. Until the address is proven, nothing the account adds can outlive a password reset: resetting signs out every session and revokes every MCP token, and the account never had a passkey or a GitHub link to keep.

Enter the new address and, if your account has a password, your current password. An account without a password needs a sign-in from the last 15 minutes instead. Unhandled sends a confirmation link to the new address and keeps using the old one until you open it. The link expires after 24 hours, and the profile tab shows the pending address until then. You can cancel the change from there.

Once confirmed, your sign-in email changes and the old address gets a short notice. An address that another account already uses gets the same answer and the same link, and opening the link refuses the change. Only someone who reads that inbox learns that the address has an account.

Password and sign-in methods

You can sign in with a password, with GitHub, or with a passkey. The Password & sign-in tab manages all three.

• Password. Changing it asks for the current one and signs out every other session. Accounts created through GitHub have no usable password at first. They can set one here without a current password, within 15 minutes of signing in.
• GitHub. Connect a GitHub account to sign in with the GitHub button. A GitHub account can be linked to one Unhandled user only. Connecting needs a sign-in from the last 15 minutes.
• Passkeys. Add Touch ID, Windows Hello or a security key, and remove the ones you no longer use. Adding one needs a sign-in from the last 15 minutes. After that, Unhandled asks for your current password, or, on an account without a password, asks you to sign in again.

Unhandled refuses to remove your last way to sign in. To disconnect GitHub on an account without a password, set a password or add a passkey first.

Forgot password on the login page emails a reset link that works once within an hour. Setting a new password through it signs out every session, including the one you reset from, and revokes every MCP token your account issued. It also turns on password sign-in for accounts that only used GitHub or a passkey.

The old address /settings/security redirects to this tab.

Sign-in protection

Unhandled limits how often the sign-in and account recovery forms can be used. Each form counts per IP address and per account, email or token, and the first limit reached applies. Failed sign-ins count, successful ones do not.

Over the limit, the form shows "Too many attempts. Try again in N minutes" and does nothing else. Self-hosted servers keep the counters in the rate_limits table of the main database. Set LIMITER_STORE=memory to keep them in the server process instead. RATE_LIMITS=off turns the limits off, for test environments only.

Sessions

Every browser you are signed in to appears with its browser, operating system, IP address, when it was last active and when it signed in. The one you are using is marked This device.

Sign out ends one session. Sign out of all other sessions ends everything except the browser you are using, and revokes every MCP token your account issued, so connected AI clients have to be authorized again. A signed-out browser is sent to the login page on its next request. Sessions that sit idle for longer than the session lifetime (two hours by default) drop off the list.

Connected apps

AI clients you approved for the MCP server, with the organization, the access they hold, when they were last used and when you allowed them. Revoke removes an app's access to that organization at once. To use it again, connect it from the app and approve it.

Email notifications

One card per organization. Its Email switches are uptime alerts, endpoint alerts, weekly recaps, exception summaries, issue comments and issue status changes. Its Inbox switches choose which categories reach your inbox: issues, uptime, alerts and feedback. See Notifications for what each one covers. The old address /o/:org/settings/notifications redirects here.

Delete your account

The bottom of the profile tab deletes your account after you type your email address. If you signed in more than 15 minutes ago, it also asks for your current password, or asks you to sign in again on an account without one. Your memberships, passkeys, sessions and preferences go with it, and you are signed out. Organizations where you are the only member are deleted with it, the same way as deleting them from their settings.

You cannot delete your account while you are the only admin of an organization. The profile tab lists those organizations with links to make another member an admin or to delete the organization.

Organization settings

Settings > General (/o/:org/settings/general) holds the organization's identity and data retention. Everyone in the organization can open it. Only admins can change anything.

Name and URL

The URL is the part after /o/ in every address, for example /o/acme/projects. It accepts lowercase letters, numbers and single dashes, and has to be unused by any other organization.

After a change, links that use the old URL still work. Unhandled redirects page visits to the same path under the new URL for anyone in the organization. Form submissions to the old URL are not redirected. Old URLs stay reserved for your organization, so nobody else can claim them.

Data retention

Data retention lists errors, traces, logs, metrics, analytics and uptime, each with how long it is kept and the most your plan allows. Admins pick a shorter period per category, or Plan maximum. Shortening hides older data at once and deletes it overnight; lengthening applies to data that arrives from now on. See data retention.

Leaving

Leaving removes you from the organization and from all of its teams. The last admin cannot leave. Make another member an admin first, or delete the organization.

Deleting

Type the organization's URL to confirm. Deleting removes its projects, services, service and deploy keys, teams, members, invitations, alerts, monitors, status pages and notification channels in one step. Services stop accepting telemetry on their next request. Uploaded source maps are deleted at once, and AI prompt and response content is erased from stored spans within minutes. Other telemetry already stored can no longer be reached, and is erased 7 days later (data retention).

New organizations

Create another organization from New organization in the organization switcher or on the General page. You become its admin. Like the one created at sign-up, it starts with a General team and a Default project.