Account & Security

Everything account-related lives under /account.

Sign-in methods

You can sign in two ways:

• Email and password — the default. Works for everyone.
• Continue with Google — available on the sign-in and sign-up pages. Google verifies your email and we link it to your Hardware Hunter account.

If you sign up with Google and later register the same email with a password, the two stay linked: signing in either way reaches the same account. Linking only happens when Google confirms your email is verified, so nobody can take over an account by claiming an email they don't control.

Google is optional. If you don't have or don't want to use a Google account, email and password works exactly the same.

Change your password

Go to Account → Change Password. You'll confirm the current password and set a new one. Password resets also work from the Forgot Password page if you're locked out.

If you signed up with Google and never set a password, the password section on /account is hidden — your sign-in runs through Google. (Setting a password on a Google-only account isn't supported yet; if you need one, email [email protected].)

Two-factor authentication (2FA)

Hardware Hunter supports TOTP two-factor authentication (the same standard Google Authenticator / Authy / 1Password use).

• Set up: Account → Two-Factor Authentication → scan the QR code with your authenticator app.
• Backup codes: setup gives you backup codes — save them somewhere safe (not in the same place as your phone). If you lose your phone and your codes, account recovery has to go through support.

2FA is optional but it's the single best thing you can turn on for a homelab-adjacent account.

Your API key

Your account has an API key: a Bearer credential that lets scripts and agents act on your account through the Hardware Hunter API. Anyone holding it can act as you, so treat it like a password.

• View or copy it: Account → API access. It stays hidden until you reveal it.
• Regenerate it: if it leaks, hit Regenerate. The old key stops working immediately and the new one replaces it.
• Scope: it reaches the API (hunts, results, notification channels, account info). Signup, billing, and password changes stay in this web app and are never exposed to the key.

Handing it to an agent? Point the agent at skill.md first: it explains the two API surfaces and asks you for the key only when it needs one.

Telegram linking

Link your Telegram from Account → Notification Channels to receive instant alerts. Hit Connect Telegram and it generates the correct deep link to the bot. Unlink anytime from the same place.

Notification channels

Account → Notification Channels manages all alert destinations: add a Discord webhook, Slack, Pushover, or ntfy topic, toggle enable/disable, mark a default, and hit Test to confirm each one actually delivers. Telegram connects here too, via the Connect button rather than a pasted URL. Email channels are system-managed.

Delete your account

Account → Danger Zone → Delete. Deletion is a soft delete: your account is deactivated (you can no longer log in), your hunts are stopped, your email is anonymized, and your notification channels are removed. The account record is retained for audit and billing history. There's no undo.

If your account is compromised

• If you have a password, change it first, then turn on 2FA. (Changing your password revokes all of your other sessions, so anyone else signed in gets kicked out.) If you sign in with Google only, sign out everywhere by deleting active sessions — contact support if you need help.
• Check Account → Notification Channels for any channel you didn't add (a hijacked session could have pointed alerts elsewhere).
• Email [email protected] with your account email.

For login trouble, the Troubleshooting page has the reset and lockout flow.