People and access

Your account and security

Notifications, personal access tokens, two-step sign-in, passkeys, connected accounts, SSH and GPG keys, and signed commits.

Everything here is in your menu (top right) → Your settings and tokens.

Notifications

The bell in the top bar collects review requests, new revisions, approvals and requests for changes (with their message), merges, finished imports and failing mirrors. Choose how you're emailed:

• Each one, a minute after it happens (unless you read it in Fettlecode first);
• One summary a day;
• Don't email me, and check in the app instead.

Emails need your admin to have set up a mail server.

Personal access tokens

A token is the password for Git over HTTPS, and lets scripts, CI and AI tools use the API as you. Under Personal access tokens, name one and make it; copy it straight away, because it's shown once. Each token shows when it was last used. Revoke one you no longer need, or that may have leaked.

Sign-in and security

Two-step sign-in

Set up two-step sign-in asks for a code from an authenticator app (such as 1Password, Google Authenticator or Microsoft Authenticator) as well as your password:

1. Scan the QR code with the app, or type the key in by hand.
2. Enter the code it shows, to check it works.
3. Save the backup codes somewhere safe. Each one gets you in once if you lose your phone.

Passkeys

Add a passkey (your device's fingerprint, face or PIN, or a security key) and sign in with it instead of typing a password.

Connected accounts

Sign in with GitHub, or with your organisation's single sign-on, as well as your password, when your admin has set them up. Connect them here.

Password

Change your password with your current one. Other devices are signed out when you do.

SSH keys

Add your public key (the contents of a file like ~/.ssh/id_ed25519.pub) to use Git over SSH. If you don't have one:

ssh-keygen -t ed25519 -C "[email protected]"

GPG keys

Add a GPG public key to have commits signed with it show as verified.

Signed commits

Commits signed with one of your SSH keys or GPG keys show as Verified when the committer email is one of yours. Commits Fettlecode writes itself (from the editor, submits and merges) are signed by the server and show as Made and signed by Fettlecode.

To sign with your SSH key in Git:

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

A branch rule can refuse unsigned commits.