Account and security
Understand your account, profile, and security settings.
Your Lepsto account identifies you across the web app and the applications you authorize. Organizations hold your team’s products; your memberships and product grants determine what you can reach.
This account is separate from the end users of a product you build.
Account creation and access
Obtain access to Lepsto before registering. An account can be created with an email, password, and display name, through a first Google or GitHub sign-in, or while accepting an invitation. Email registration sends a verification link; follow it to confirm the address.
Your first product can create an organization with you as its owner. Accepting an invitation joins the inviting organization without creating another one. One account can belong to several organizations, with one active at a time.
What the account holds
Field | Meaning |
|---|---|
Email | Unique account address. |
Email verified | Whether the verification link has confirmed the address. |
Display name | Name shown to other members. |
Avatar | Optional profile picture URL. |
Locale and timezone | Stored presentation preferences. |
Status | ACTIVE, SUSPENDED, or DELETED. |
Other members’ public profile view includes your identifier, display name, avatar, and status, but not your email. Membership-management responses have their own fields and access rules.
What you can manage
Use Account → Security for two-factor authentication and trusted devices. You can also verify your email, switch your active organization, and sign out of your current session.
There is no self-service editor for your email, display name, avatar, locale, or timezone after account creation. Password changes and password resets are also not available as self-service account actions. Accounts created through Google or GitHub have no Lepsto password.
What happens when access ends
A suspended or deleted account is rejected at sign-in, token refresh, and authenticated requests. Deleted accounts are hidden from profile lookups.
Browser sessions, OAuth credentials, and API keys are separate. Ending a browser session does not revoke the other credentials. Read Sessions, Sign-in and authorization, and API keys for their limits.