Your Hexel account
The account you sign in with, the sign-in methods and two-factor authentication it supports, and how it relates to the organizations you belong to.
On this page
Your Hexel account is you, as a person. You use it to sign in to the console and to other Hexel Studio apps. Accounts are provided by Hexel Accounts at identity.hexelstudio.com.
An account is separate from the organizations it belongs to. The account holds who you are and how you sign in. Each organization holds what you may do there.
Sign-in methods
You can sign in with any of these:
| Method | How it works |
|---|---|
| Email and password | Enter your email, then your password. Use Forgot password? to reset it by email. |
| Email sign-in link | Choose Email me a sign-in link instead and open the link sent to your address. |
| Passkey | Choose Continue with a passkey and confirm with your device: a fingerprint, face scan, PIN or security key. |
| Choose Continue with Google. | |
| GitHub | Choose Continue with GitHub. |
Your email address must be verified before you can use Hexel Studio.
Two-factor authentication
Two-factor authentication is required for every Hexel account. The first time you sign in without a second factor set up, you're asked to add one:
- An authenticator app (TOTP), which shows a six-digit code that changes every 30 seconds. When you set one up you also get backup codes. Each backup code works once, in place of an app code, if you lose access to the app.
- A passkey.
After that, every sign-in asks for the second factor, except a sign-in with a passkey: a passkey already proves both who you are and that you hold your device.
You manage passkeys, your authenticator app and backup codes in the Security settings of your Hexel account. The same settings list the sessions where you're signed in and let you sign one out, so that device has to sign in again.
Accounts and organizations
| Account | Organization membership | |
|---|---|---|
| What it is | You, as a person | Your place in one organization |
| How many | One per person | One per organization you belong to |
| Holds | Email, name, sign-in methods, second factors | Your role in that organization and the policies that apply to you there |
| Created when | You sign up | You create an organization, or accept an invitation to one |
One account can belong to several organizations. Your permissions in each organization are separate: being an owner in one organization gives you nothing in another.
When you create an organization you become its owner. To join an existing organization, a member who may invite people sends an invitation to your email address; see Members and invitations.
One organization at a time
Every access token is for exactly one organization. When you switch organizations in the console, it gets a new token for the organization you pick. A token can't be changed to another organization afterwards. See Access tokens.
Before you belong to any organization, you can sign in and create one, but there's nothing else to act on yet.
Leaving or losing access
If you're removed from an organization, or the organization is deleted, your account stays. You keep your sign-in methods and your memberships in other organizations. To delete the account itself, see Your data.
A token for an organization can be issued or renewed only while your membership there is active and the organization is active.
Accounts are for people
Programs don't use Hexel accounts. A script, server or CI job gets its own identity in your organization, a service user, with an API key or an OAuth client. That way you can give it only the permissions it needs, and revoke its credentials without touching anyone's account.