For AI agents: fetch the complete documentation index at /llms.txt, the full documentation corpus at /llms-full.txt, the agent skill at /skill.md, or this page as Markdown at /docs/web/account.md (or send Accept: text/markdown).
Account and security
Profile, sessions, passkeys, data export, and deletion.
Beginner walkthrough
Prerequisites: Read the two beginner guides below, finish Web local setup, and open this monorepo at its root in your editor. Web settings belong in apps/web/.env.local; Next.js does not read the root .env. /dashboard in the default fake mode is a no-database demo; /auth needs a migrated database.
Quick terms: a workspace is one team's separate users, data, and settings. The server is the trusted backend; keep provider keys out of browser and phone code. A migration is a versioned database change that creates or updates tables. An AI model is the engine that answers; the model catalog is the server's list of available model IDs and prices. A provider is an outside service such as an AI, email, or billing service. An entitlement is a grant that lets a workspace use a feature. A webhook is a message one service sends to another service's URL.
1. Sign in to /auth in two test browser sessions, then sign out from one session.
2. Request a protected page from the signed-out session; the server should require sign-in. This guide covers session behavior, not a cross-device session-revocation screen.
3. To inspect your own data export, use GET /api/account/export; it must not include another user's or workspace's private records.
For custom code, start with the supplied prompts/README.md and copy the closest prompt: prompts/new-app-screen.md for an app screen or prompts/new-landing-page.md for a public page. For server, database, or provider work, give your coding agent this guide's task and ask it to read AGENTS.md, .ai/PROJECT_CONTEXT.md, and matching .ai/ mirrors; inspect the exact source files named here; list files and checks before editing; preserve workspace ownership and server-only secrets; and show you the diff. Tell it the behavior you want, input and output fields, allowed roles, expected success and errors, and the test account, provider, or device. Use sample values; never paste a real secret.
Manage active sessions
Security settings expose the shipped session and credential controls through the selected auth engine. Revoking a session must invalidate server access, not only clear a local screen. Review web-settings-security.ts, the settings panels and auth runtime before extending them.
Export account data
The signed-in GET /api/account/export route provides the GDPR data export, including authored content. Keep access tied to the requesting identity and audit the shape whenever you add user-owned records. Never include provider tokens, signing secrets or another workspace's private data.
Verify account transitions
Test current-session sign-out, revoking another session, expiry, reauthentication and export access. Clear the previous account's cached presentation before rendering the next user's workspace.
Setup and configuration
Account surfaces live under /settings — general, security (password, sessions, passkeys), notifications, appearance, and audit. Each section reads server state and writes through server actions that re-verify the session.
Data export (src/data-export.ts) assembles a member's workspace-owned records; account deletion runs through the same ownership boundary. Both exist because privacy obligations are product requirements, not extras.
/settings/general name, avatar, email
/settings/security password, sessions, passkeys
/settings/notifications per-category opt-outs
/settings/appearance theme, density, layoutImplementation workflow
Keep security mutations re-authenticated where the provider supports it — password change, key rotation, deletion. Session listing must show the caller's own sessions only, and revocation must actually invalidate the token.
Export only data the member owns — reuse the workspace-scoped repositories rather than ad-hoc queries. Deletion ordering matters: revoke sessions and clear dependent records before removing the account row.
Verification and troubleshooting
Verify a revoked session loses access immediately, an export contains the member's records and not another workspace's, and deletion leaves no orphaned ownership rows. Test passkey ceremonies only on HTTPS origins.