Account and security

Your profile is where you manage how you appear, how you sign in, and how securely. Open it by selecting your avatar and name at the bottom of the sidebar, or go to the profile page directly.

Your identity

• Avatar - upload a picture, or let orboto generate a coloured initials avatar. You can pick the avatar colour or leave it automatic.
• Name and email - shown to teammates on tickets, comments, and mentions.
• Theme - Light, Dark, or System (also on the sidebar switch).
• Language - the interface language.
• Availability visible to teammates - lets colleagues see a green/amber/red capacity badge for you in assignee pickers. Your actual calendar details are never shared, only that busy/available signal - turn it off to hide even that.

Password

In the password section, change your password by entering your current password and a new one. If your workspace uses single sign-on, you may sign in without a password at all.

Two-factor authentication

Two-factor authentication (2FA) adds a second step at sign-in so a stolen password is not enough. orboto supports two kinds, and you can use both.

Authenticator app (one-time codes)

1. Select Enable in the two-factor section.
2. Scan the shown QR code with an authenticator app on your phone (or type the key manually).
3. Enter the six-digit code the app shows to confirm.
4. Save your recovery codes. These one-time backup codes let you get in if you lose your phone - store them somewhere safe. Without them, losing your device can lock you out.

To turn it off later, use Disable and confirm.

Passkeys

A passkey signs you in with your device's fingerprint, face, or PIN - no code to type, and nothing to phish.

1. Select Add passkey.
2. Give it a label (for example "work laptop") so you can recognise it later.
3. Follow your device's prompt to create the passkey.

Your registered passkeys are listed with when they were added and last used; remove any you no longer trust.

The extra-confirmation prompt (step-up)

Some sensitive actions ask you to re-confirm your identity even though you are already signed in - this is called step-up. When it happens, a small dialog asks for your authenticator code (or passkey). Enter it and the action continues. This protects high-risk operations from being done by someone who wandered up to your unlocked screen.

Active sessions

The sessions section lists every device currently signed in to your account, with its last activity. Your current session is marked. If you see something you do not recognise, revoke that session, or revoke all others to sign out everywhere except here.

Calendar feed and connected calendars

• Calendar feed - a personal, read-only iCal subscription URL you paste into Google Calendar, Apple Calendar, or Outlook. Choose which items it carries: absences, ticket due dates, milestones, and your timesheet-submission deadline. Regenerate the URL if it leaks, or disable the feed entirely.
• Connected calendars - connect Google Calendar, Microsoft 365, or a CalDAV server (which uses a server URL, username, and app password instead of the OAuth flow the other two use) so orboto and your calendar sync both ways: push your absences and planned work blocks out, and pull your busy times back in to feed the availability signal above. Each connection can be resynced on demand or disconnected.

Email preferences

• Daily digest email - a once-a-day summary instead of many individual emails.

Personal API keys

If you build scripts or connect other tools, the API keys section lets you create personal keys that act on your behalf through orboto's API:

1. Select New key, give it a name, and optionally set an expiry date.
2. Mark it as an agent key if a script or AI agent will use it - work done through an agent-flagged key is recorded as agent work rather than attributed as your own manual activity.
3. Create it - the secret is shown once. Copy it immediately; it is never shown again.
4. Later, rotate a key to issue a new secret while invalidating the old one (without recreating the key's name/settings), edit its expiry inline, or delete it when you no longer need it.

Treat a key like a password. For connecting AI clients specifically, see Integrations.

Backup approver

If your workspace uses backups, you may be able to nominate a backup approver - a trusted colleague who can approve a sensitive restore on your behalf. Set this in your profile where offered.

Troubleshooting

• I lost my phone and can't get in. Use a saved recovery code from when you enrolled 2FA. If you have none, ask a workspace administrator to reset your two-factor setup.
• A step-up prompt keeps interrupting me. It only appears on genuinely sensitive actions (for example, changing security settings or approving a destructive AI action) - it is not something you can turn off, by design.
• My API key stopped working. Check its expiry date, or whether it was rotated (rotating issues a new secret and invalidates the old one immediately).
• My calendar feed shows nothing. Confirm the feed is enabled and at least one scope is turned on; some calendar apps cache a subscribed feed for several hours before refreshing.
• A connected calendar shows a sync error. Use Resync first; for CalDAV, a repeated failure usually means the server URL, username, or app password needs re-entering.