# Sign In and Account Access

> Create an account, sign in, recover access, and complete two-step verification safely.

Source: https://docs.thalovant.com/account/sign-in-and-account-access/

---
Use this page when the question is about getting into your account, not changing hubs or connections.

It covers account creation, sign-in, single sign-on, email verification, password reset, authenticator codes, and recovery codes.

## Signing In, Briefly

You sign up with any email address or one of the sign-in providers. If you arrived from a public hub, it stays attached through signup. Forgot your password? The reset link is on the sign-in page. Asked for a code? That's two-step sign-in: use the authenticator app, or one of the recovery codes you saved. Once you're in, everything about security lives in Profile.

## Create an Account

1. **Open Create account.** Use an email address you check and your real display name.
2. **Choose a strong password or sign-in provider.** Use Google or GitHub when that option appears and fits your team.
3. **Check your inbox.** The signup page keeps your email address and next steps visible. Open the email, select **Verify email address**, then select **Confirm email address** on the page.
4. **Sign in to Thalovant.** Use your email and password after confirmation. If you started from a public hub in the same browser tab, the saved connection path continues after sign-in.
5. **Open Profile later.** Add two-step sign-in and store recovery codes before handling private setup material.

## Verification Email Help

Verification links expire after 24 hours. Opening the page doesn't verify your account until you select **Confirm email address**.

- **Email hasn't arrived:** check Junk or Spam, then select **Resend verification email** on the signup page. You don't need to enter your address again; the button shows a countdown before another request is allowed. Work mailboxes may also quarantine messages. Requests are limited to one per minute and five in a rolling 24 hours, including the original registration email.
- **Wrong address:** select **Use a different email address** to return to account creation. This starts another registration; it doesn't change the account already created.
- **Link has expired:** enter your signup email in the recovery form on the verification page and request a new link. Earlier unexpired links still work until your address is confirmed.
- **Link was already used:** try signing in. Confirmation doesn't sign you in automatically; your password and any required two-step verification still apply.
- **Temporary verification error:** select **Try again** when your connection is available.
- **Still blocked:** contact [support@thalovant.com](mailto:support@thalovant.com) with the signup time and the message shown. Don't send your password or verification link.

The resend form uses the same response whether an account exists or is already verified, to keep account details private. Opening a link alone doesn't consume it, including when an email security scanner previews the page.

## Sign In

Use the same method you used to create the account:

- email and password;
- Google sign-in when offered;
- GitHub sign-in when offered.

If the account was first created with email and later uses a provider with the same email address, Thalovant keeps the identity unified.

## Two-Step Verification

MFA (two-step verification) is optional for Free accounts. After verifying your email, you can sign in and begin setup without enrolling an authenticator. You can enable it later in **Profile & security**; the optional reminder can be dismissed.

If you already turned MFA on it stays on, and signing in still asks for your authenticator or a recovery code. Paid accounts follow whatever security policy the account has been given. Actions that reveal setup material ask you to verify again either way.

  
    Use the six-digit code from your authenticator app.
  
  
    Use one saved recovery code when the authenticator app is unavailable.
  

When enabling two-step verification in Profile, scan the indigo QR code with the Thalovant logo using your authenticator app. If it can't scan, enter the setup key shown beside the code. Keep both the QR code and setup key private.

Each recovery code works once. Store recovery codes somewhere safe outside Thalovant.

## Recover Access

| Situation | First move |
| --- | --- |
| Forgot password | Use **Forgot password?** from the sign-in page. |
| Reset link expired | Request a new password reset link. |
| Authenticator unavailable | Use a saved recovery code. |
| No recovery codes left | Sign in if you can, then regenerate recovery codes from Profile. |
| Account still blocked | Prepare a support request without secrets. |

## What Not to Share

Never share:

- passwords;
- authenticator codes;
- recovery codes;
- setup links;
- copied setup commands;
- connection files;
- payment details.

  Support can help with context. Support should never need your password, authenticator code, recovery code, or private setup material.

## Account Access Is Ready When

Your account access is ready when:

- you can sign in using the expected method;
- email verification is complete when required;
- two-step verification is enabled when your workspace requires it;
- recovery codes are stored safely;
- Profile shows the expected browser sessions.

Open Profile and Security