Account and security
Open Sigma Auth to sign in, or Signup to create a new account. Use Restore for an existing encrypted backup. Do not create another identity just because a recovery lookup failed.
Select the right profile
The account navigation is scoped to /account/{bapId}. One account can contain multiple identities. Select the intended profile before editing it, connecting a wallet, managing an OAuth client, or reviewing credentials. The primary profile is used by some account-wide services, including current NFT verification.
A Better Auth account session proves account login. A local backup unlock makes signing material available. A wallet's approval authorizes a wallet operation. These states are separate: being signed in does not mean every key is unlocked.
Settings
| Tab | What to manage |
|---|---|
| Accounts | Link/unlink configured providers and import supported profiles |
| Security | Passkeys and key/backup-related controls supported by the current identity |
| Devices | Review tracked devices/sessions and remove access you no longer need |
| Cloud Backup | Check status, upload ciphertext, and download a backup |
| Notifications | Select supported account email notifications |
| Appearance | Choose presentation preferences |
Keep an offline encrypted backup and working recovery factor before removing a provider or passkey. Removing a device record or signing out is not the same as revoking an OAuth application's grant. Review Authorized Apps separately.
Passkeys, email, and two-factor authentication
The server supports Better Auth passkeys, verified email/password sign-in, email OTP, and two-factor endpoints. Available UI choices depend on enrollment and device support. The generated API reference documents the enabled Better Auth methods.
A PRF-capable passkey can be enrolled specifically for backup unlock on supported browsers/authenticators. An ordinary passkey session does not automatically decrypt a backup. The account password and backup encryption password are separate credentials; resetting one does not reset the other.
Authorized applications
Open Authorized Apps to review consents and revoke connections you no longer want. Inspect the application name, requested scopes, and selected BAP identity before approving OAuth consent. Revoking a connection cannot erase information the application already received.
Other account tools
- Wallets: connect and choose addresses; see wallet API.
- Credentials: check evidence and wallet certificate availability; see wallet credentials.
- Team / Delegations: manage membership and separately signed authority; see teams.
- OAuth Clients: register integrations and inspect analytics; see client management.
- Handle: the incubating handle workflow is gated; see handles.
Key rotation controls must not be interpreted as an available hosted rotation API: /api/bap/rotate currently returns 501. Seed creation and phrase recovery also have format-specific availability limits in backups.