# Your account

> Sign up with an invite, confirm your address, reset a forgotten password and change your email.

Web page: https://infrainbox.app/docs/start/account/

Everything on this page that sends you an email needs a server that can send mail. InfraInbox Cloud always can; a self-hosted server can once its operator sets `smtp.host` (see [Configuration](https://infrainbox.app/docs/self-hosting/configuration.md#email)). Without it, the links below don't appear, and the operator resets a password with `infrainbox admin reset-password`.

Every link InfraInbox mails you works once. Its secret sits after the `#` in the address, so it never reaches the server's logs, a proxy's or another site.

## Sign up with an invite (InfraInbox Cloud)

The Cloud beta is invite-only. Your invitation links to **`/signup`** (dashboard screen `/signup`):

1. Enter your email address and a password of at least 15 characters.
2. InfraInbox mails a confirmation link to that address. It works for 24 hours.
3. Open the link and enter the same password to confirm the address. Asking for the password means nobody else who reads the mail can confirm an account you didn't create.

You can sign in and set things up before you confirm, but nothing is sent anywhere — no Telegram message, no push — until the address is confirmed. A banner at the top of every screen says so while it is outstanding, with **Send a new link** in it; a new link replaces the old one. The banner goes as soon as the address is confirmed, wherever you confirmed it.

An invitation works once. If the address already has an account, you get an email saying so instead of a second account.

## Forgot your password

On the sign-in page, choose **Forgot password?** and enter your confirmed email address. If an account uses it, a reset link arrives; the page says the same either way, so it never tells anyone which addresses have accounts.

The link works once and for 30 minutes, and asking again replaces it. Setting a new password signs out every browser signed in to the account. Your paired phones keep working: the page lists them, so you can revoke any you don't recognise under **Settings → Devices** (dashboard screen `/settings/devices`).

A second factor (TOTP) is still asked for at the next sign-in: a reset changes the password only.

## Change your email address

Under **Settings → Account** (dashboard screen `/settings/account`), a new address needs a fresh re-authentication. InfraInbox then mails a confirmation link to the **new** address; it works for 24 hours. Until you open it, the account keeps its current address, and sign-in and password resets still use it.

Once you confirm, the account uses the new address, the old address gets a message saying it was replaced, and any reset or confirmation link still open for the old address stops working.

## Close your account

Under **Settings → Account** (dashboard screen `/settings/account`), **Close account** asks you to type your own email address, then to confirm it's you. There is no undo.

Closing signs out every browser and paired phone, cancels anything still queued for them, and closes the workspaces you own alone. A workspace that has other members is not closed with you: InfraInbox refuses and names it, so make someone else an owner first, or delete the workspace yourself. A self-hosted instance refuses to close its last administrator's account for the same reason.

Your rows are removed within 30 days, and backups holding them age out within 35.
## Join a workspace you were invited to

A workspace invitation is a different link from a beta sign-up: it adds an account you already have to somebody's workspace. Sign in first, then open the link, which lands on **`/invite`** (dashboard screen `/invite`) and puts you straight into the workspace. See [Workspaces and members](https://infrainbox.app/docs/start/workspaces.md#accept-an-invitation).

## Invite people to the beta (operators)

On InfraInbox Cloud, the operator issues invites from a shell:

```bash
infrainbox admin invites create --batch wave1 --count 20
infrainbox admin invites create --batch wave1 --email ops@example.com --email dev@example.com
```

`--batch` names the wave (lowercase letters, digits, `.`, `_` or `-`); it is never an email address or a person's name. Without `--email`, the command prints one sign-up link per invite to hand out; with it, each address gets its own invite by mail. Invites expire after 14 days unless `--expires` says otherwise, and each is stored only as a hash.