Account security

• —You sign in with your email address and a password. Changing the password, in Settings → Account, asks for the current one first, and a forgotten one is reset from a link mailed to that address.
• —Two-factor is an authenticator app, such as Google Authenticator, 1Password, Authy or anything else that reads a QR code. Six digits, rotating every thirty seconds. Turning it on asks for your password, shows the code to scan, and does not switch it on until you type six digits the app produced, so a secret that was scanned wrong is caught while you can still sign in rather than the next time you try. Turning it off asks for the password too.
• —Ten recovery codes are shown once, at the end of that setup, and each one signs you in exactly once if the phone is gone. They are not shown again and cannot be read back out of the account later, so the moment to save them is while they are on the screen.
• —A workspace can require it, from the Privacy tab of its settings page. It takes effect immediately, including for people who are already signed in: a member without an authenticator app meets a lockout screen instead of that workspace’s mail until they enrol or sign in with a passkey, and an invitation cannot be accepted without one of the two either. Turning the requirement back off lets everyone it had locked out straight back in.
• —Deleting the account is on that same Account screen. It removes the account, every domain on it and all the mail those domains have received; it is confirmed by a link mailed to you rather than by the click alone; and it cannot be undone.
• —Sensitive changes ask for a code first: creating, rotating or editing an API key, removing a domain or an address, moving a domain, changing forwarding, roles, members, rules or webhooks, setting a password for an address, exporting, and deleting a workspace. The code comes from your authenticator app when two-factor is on, or by email when it is not, and one correct code covers that sign-in for 60 minutes. A call made with an API key is never asked for one, and a connected app asks the same way, or is allowed changes for 60 minutes from Account → Connected apps.

• —A passkey signs you in with your fingerprint, your face or the screen lock of your device, with nothing to type. Add one in Account → General → Security with Add a passkey: give it a name, then confirm on the device when it asks. Adding one asks you to confirm it is you first, as every sensitive change does.
• —The passkey stays on the device or in the password manager that made it. Nextmail holds its public key and the name you gave it, never the private key, and the device has to check that it is you every time the passkey is used.
• —Sign in with a passkey, on the sign-in page of the website, asks for no email address, no password and no code from an authenticator app. A workspace that requires two-factor lets you in on a device where you signed in with a passkey, even when the account has no authenticator app.
• —A passkey also confirms a sensitive change. In the Confirm it is you dialog, choose Use a passkey where you would have typed a code.
• —An account holds up to 20 passkeys. Each one shows whether it is synced between your devices or stays on one, when it was added and when it was last used. Rename one to tell them apart, and remove one you no longer use: it stops signing in at once, and stays on the device until you delete it there.
• —You are told by email when a passkey is added or removed, and both are written to your security activity.
• —Passkeys work on openemail.uk. A workspace’s own webmail domain, such as mailbox.yourcompany.com, signs you in with your password, and a password set for one address has no passkeys.
• —The phone app lists your passkeys, renames them and removes them. A passkey is added in a browser.

• —Account → General → Devices lists every browser and phone signed in to your account, the one you are using first. Each shows the browser and the system, or the Nextmail app, the country and city it was last used from, how it signed in and when it was last active. The place is a country and a city, never an IP address.
• —Sign out, beside a device, signs it out at once: its next request is refused and it has to sign in again, and a phone stops getting notifications.
• —Sign out everywhere else signs out every other browser and phone and keeps the one you are on. Tick Also disconnect connected apps and every app you connected loses its access too, until you connect it again.
• —Changing your password signs out every other device, and resetting a forgotten one signs out all of them.
• —A sign-in from a browser or phone that has not signed in to your account before sends you an email with the device and the place.

• —Security activity, in Account → General → Security, is the log of your own sign-in: each sign-in with its device, its place and how it was made, devices signed out, password changes and resets, two-factor turned on or off, and passkeys added or removed. A sign-in from a device that had not signed in before is marked New device.
• —A workspace keeps a log of its own, Security log on the Privacy tab of its settings page: invitations sent and withdrawn, members added and removed, role changes, roles created, changed and deleted, the two-factor requirement, a password set for an address or removed from it, and every change to directory sync. Each entry names who did it: a person, an API key or directory sync. Reading it takes permission to see the members.
• —Nothing in either log is edited or removed. Your own is kept until the account is deleted, and a workspace’s until the workspace is deleted.

The same is on the REST API, the SDKs, the command line and the MCP server. GET /account/sessions lists the devices, and DELETE /account/sessions/{sessionId} and DELETE /account/sessions sign one out or all of them. GET /account/passkeys lists the passkeys, and PATCH and DELETE /account/passkeys/{passkeyId} rename and remove one. GET /account/security-events reads your log and GET /security/events the log of the workspace, which needs members:read. The account calls need account:read to read and account:write to change.

• —A key or a connected app is not a signed-in device, so through them signing out everywhere signs out every browser and phone. With connectedApps, the REST API removes every connected app but the one making the call, and the MCP tool removes the client that called it as well.
• —No call adds a passkey, because only the device that holds it can.

• —Every way into the workspace asks for it: the website, the phone app, mail and calendar apps that sign in with an app password or a password for one address, CalDAV and CardDAV, and apps connected through OAuth or MCP. A person whose account has neither an authenticator app nor a passkey is refused on each of them until they turn one on.
• —A mail app shows why it was refused. Turn on an authenticator app or add a passkey under Account → General → Security, and the same app password works again. A password for one address has no passkeys, so it needs an authenticator app and then an app password, because a mail app cannot ask for the code.
• —Mail and calendar apps that are already connected are cut off the next time they check in, within about five minutes.
• —A connected app is answered with 401 grant_access_lost and a message about two-factor until the person who approved it turns it on. API keys belong to the workspace and keep working.