Skip to content

Account security and recovery

Username/password accounts, passkeys, recovery codes, and active sessions without email.

Describes Novus v4.7, released .

Why sign in

Guest editing and export stay free. Signing in adds durable Turso revisions, private assets, cross-device access, profiles, community, and notifications.

Recovery

Novus sends no email. Save the recovery codes shown at signup and add a passkey. Codes are hashed, single-use, and replaced as a complete set.

  • Use a passkey or username plus an unused recovery code at `/recover`.
  • Recovery creates a short-lived HttpOnly session and never returns a reset token in JSON.
  • Without a passkey, recovery code, or authenticated trusted session, the account cannot be self-recovered.

Sessions and admins

Security settings list active devices without exposing session tokens. Admins use the normal account session; privileged changes require a fresh passkey and create an immutable audit record.

ShareXFacebookLinkedInPinterestWhatsAppReddit

Keep going

Looking up a word rather than a workflow? The glossary defines every term the editor uses. For what a specific control does on a specific engine, the engine reference publishes the full control table.

Was this page helpful?

Anonymous. Only this page’s address and your yes/no are recorded, and only if you allowed analytics cookies.