Accounts and security

You will learn how Tixio accounts, sign-in methods, sessions, profile details, password rules, email changes, and multi-factor authentication fit together.

This page explains the concepts. For step-by-step instructions, use Sign up, sign in and sessions, Manage account security, and Manage API keys and service accounts.

Account identity

Your Tixio account identifies you across every workspace you can access. Your name, email address, and profile photo appear in places such as assignee pickers, member lists, issue activity, comments, mentions, and dashboards.

Your account is separate from workspace membership. You can have one account and belong to many workspaces. If you are invited to a workspace or project, use the same email address that received the invitation unless your admin tells you otherwise.

Tixio can support several sign-in paths:

Email and password for accounts created directly in Tixio.
Google sign-in when available on the sign-in page.
Workspace SSO for workspaces configured with an identity provider such as Okta or another OIDC provider.
Invitation links that route you to the right account action before returning you to the invitation.

Some account-security controls apply only to email/password accounts. For example, Google or SSO sign-in users cannot set a local password or enable email/password MFA from the Account security page.

Email verification

When you create an email/password account, Tixio sends a verification link. You need to open the verification email to finish account creation and sign in.

If you started from an invitation link, Tixio preserves that invitation path so you can return to it after signup, sign-in, or email confirmation.

Sessions

A session keeps you signed in after you authenticate. Tixio is designed to keep sessions stable through normal refreshes and deploys. If a newer frontend deploy is available, the app may prompt you to refresh.

Use the log out control when you are done on a shared computer or when you need to switch accounts. The workspace picker also shows your signed-in account and a log out control.

Password requirements

Tixio shows a live requirements checklist when you create or change an email/password account password.

You can use either:

A passphrase of at least 12 characters.
Or a shorter complex password with at least 8 characters, an uppercase letter, a lowercase letter, a number, and a special character.

Choose a password that is unique to Tixio. If your organization uses a password manager, store it there.

Account security page

The Account security page is where email/password users manage:

Password changes.
Optional revocation of all API keys when changing the password.
Email address changes.
Multi-factor authentication.

Email changes use confirmation links. Tixio sends a confirmation link to the new inbox, and the message to your current address includes a cancel link in case the change was not yours.

Multi-factor authentication

Multi-factor authentication, or MFA, adds an authenticator-code step to email/password sign-in.

Tixio uses authenticator-app codes. During setup, Tixio shows:

A secret key.
A provisioning link for an authenticator app.
Recovery codes, shown once.
A verification-code field to finish enabling MFA.

Store recovery codes somewhere safe. Each recovery code works once if you lose access to your authenticator device.

To disable MFA, you need your current password and either an authenticator code or a recovery code.

API keys

Personal API keys let MCP clients, scripts, and integrations call Tixio without your interactive session. Keys use the tix_ prefix and are shown in full only once at creation.

Workspace service accounts are separate workspace-owned identities for shared integrations. They receive project roles instead of inheriting a human user's access.

For the full model — scopes, rotation grace, audit, and security — read API keys and programmatic access.

Profile photo

Your profile photo appears wherever Tixio shows your avatar. The Profile page lets you upload or remove your photo. Supported formats are PNG, JPEG, GIF, and WebP up to 5 MB.

If you remove your photo, Tixio falls back to an initials avatar.

SSO and local account settings

Workspace SSO is managed by workspace admins. If you sign in through SSO, your organization's identity provider controls the primary authentication flow.

Use Tixio account security settings for controls that are available to your sign-in method. Use your identity provider for SSO password, MFA, and account recovery controls when your organization requires SSO.

Invitation routing

Invitation links can point to a workspace or a project. When you open an invite while signed out, Tixio checks what your account needs and routes you to one of these paths:

Create an account.
Sign in.
Confirm your email.

After authentication, Tixio returns you to the invitation so you can accept it. If the invitation has expired, has already been accepted, or is invalid, Tixio shows an unavailable-invitation message.