← Back to docs

Sign in to Dawvia with a password, OAuth, passkeys or an app QR code; verify your email, reset a forgotten password, and manage sessions, devices and API tokens.

Authentication and login

Dawvia uses one identity across the web Portal, the Console and the mobile app. Sign in once and your session follows you across every surface you are allowed to see.

Sign-in methods

  • Email and password — the default. Open sign in, enter your credentials,

and you land in your personal area. Requests are CSRF-protected and rate-limited.

  • OAuth / social — sign in with a supported provider. If the provider does not

return an email address, Dawvia asks you to complete it once before the account is created.

  • Passkeys (WebAuthn) — register a passkey to sign in with Face ID, Touch ID, a

security key or your device PIN, with no shared secret to phish.

  • App QR code — scan a one-time code from an already signed-in app to log a new

browser in without typing a password.

Create an account and verify email

  1. Go to sign up and register with your email address.
  2. We send a verification link; until you confirm it, a reminder banner stays on your

overview page and sensitive actions such as billing are gated.

  1. Click the link to activate your account.

To connect your AI IDE accounts after signing in, see connect Cursor and Windsurf accounts.

Reset a forgotten password

From sign in, choose Forgot password? to reach the password reset page. We email a time-limited link; opening it lets you set a new password. The link is single-use and expires quickly.

Sessions, devices and API tokens

  • Your session is a secure, HttpOnly cookie and is never exposed to page scripts.
  • Review active sessions and sign out a specific device from your personal

Devices & sessions area; a global sign-out invalidates every session at once.

  • For CLI and extension access, mint scoped API tokens. A token secret is shown

only once at creation — copy it then, because it is never displayed again.

Security boundaries

  • Passwords and tokens never appear in URLs, logs or analytics.
  • Application and admin pages are noindex, so authenticated surfaces are never indexed

by search engines.

  • For the full encryption, audit and permission model, read

security & compliance and team & organization management.

Next steps