---
title: Your Hexel account
description: The account you sign in with, the sign-in methods and two-factor
  authentication it supports, and how it relates to the organizations you belong
  to.
url: https://hexelstudio.com/docs/identity/accounts
---

Your Hexel account is you, as a person. You use it to sign in to the console and to other Hexel Studio apps. Accounts are provided by Hexel Accounts at `identity.hexelstudio.com`.

An account is separate from the organizations it belongs to. The account holds who you are and how you sign in. Each organization holds what you may do there.

## Sign-in methods

You can sign in with any of these:

| Method | How it works |
| --- | --- |
| **Email and password** | Enter your email, then your password. Use **Forgot password?** to reset it by email. |
| **Email sign-in link** | Choose **Email me a sign-in link instead** and open the link sent to your address. |
| **Passkey** | Choose **Continue with a passkey** and confirm with your device: a fingerprint, face scan, PIN or security key. |
| **Google** | Choose **Continue with Google**. |
| **GitHub** | Choose **Continue with GitHub**. |

Your email address must be verified before you can use Hexel Studio.

## Two-factor authentication

Two-factor authentication is required for every Hexel account. The first time you sign in without a second factor set up, you're asked to add one:

- **An authenticator app** (TOTP), which shows a six-digit code that changes every 30 seconds. When you set one up you also get backup codes. Each backup code works once, in place of an app code, if you lose access to the app.
- **A passkey.**

After that, every sign-in asks for the second factor, except a sign-in with a passkey: a passkey already proves both who you are and that you hold your device.

You manage passkeys, your authenticator app and backup codes in the **Security** settings of your Hexel account. The same settings list the sessions where you're signed in and let you sign one out, so that device has to sign in again.

## Accounts and organizations

| | Account | Organization membership |
| --- | --- | --- |
| **What it is** | You, as a person | Your place in one organization |
| **How many** | One per person | One per organization you belong to |
| **Holds** | Email, name, sign-in methods, second factors | Your role in that organization and the policies that apply to you there |
| **Created when** | You sign up | You create an organization, or accept an invitation to one |

One account can belong to several organizations. Your permissions in each organization are separate: being an owner in one organization gives you nothing in another.

When you create an organization you become its owner. To join an existing organization, a member who may invite people sends an invitation to your email address; see [Members and invitations](https://hexelstudio.com/docs/identity/members).

### One organization at a time

Every access token is for exactly one organization. When you switch organizations in the console, it gets a new token for the organization you pick. A token can't be changed to another organization afterwards. See [Access tokens](https://hexelstudio.com/docs/identity/tokens).

Before you belong to any organization, you can sign in and create one, but there's nothing else to act on yet.

### Leaving or losing access

If you're removed from an organization, or the organization is deleted, your account stays. You keep your sign-in methods and your memberships in other organizations. To delete the account itself, see [Your data](https://hexelstudio.com/docs/identity/your-data).

A token for an organization can be issued or renewed only while your membership there is active and the organization is active.

## Accounts are for people

Programs don't use Hexel accounts. A script, server or CI job gets its own identity in your organization, a [service user](https://hexelstudio.com/docs/identity/service-users), with an API key or an OAuth client. That way you can give it only the permissions it needs, and revoke its credentials without touching anyone's account.