# Sign-in methods and emailed links > The ways to sign in to EmailConnect, what two-factor authentication covers, and how to switch off emailed sign-in and password-reset links Source: https://emailconnect.eu/help/sign-in-security/ There are several ways into an EmailConnect account. This page lists them, says which of them two-factor authentication covers, and explains the setting that switches off the links we send by email. ## Ways to sign in - **Email and password** - **A sign-in link sent to your email address** ("magic link"). The link is valid for 10 minutes - **Google or GitHub** - **A passkey** — see [Passkeys](https://emailconnect.eu/help/passkeys/) A forgotten password is reset through a link sent to your email address. Using that link signs you out on every device. An account created with a sign-in link, Google or GitHub has no password yet. To set one, go to **Settings → Account** and choose **Email me a link** next to the password field: we email you a link, and the password is set from that link. Setting it signs you out on every device. ## Adding Google or GitHub to your account Signing in with Google or GitHub does not attach that sign-in to an account that already exists for your email address. The sign-in page tells you an account exists; sign in with your password or a sign-in link instead (or reset your password). This stops someone who created an account with your address before you from capturing your Google or GitHub sign-in. To use Google or GitHub as well, add it yourself: 1. Sign in and go to **Settings → Account** 2. Under **Sign-in methods**, choose **Connect Google** or **Connect GitHub** and confirm with the provider - The Google or GitHub account must use **the same email address** as your EmailConnect account. - Adding a sign-in method, or a passkey, needs **a sign-in from the last hour**. If you signed in earlier, sign out and in again first. - **Remove** takes a method off. Removing the password asks for your current password, and your last sign-in method cannot be removed. ## What two-factor authentication covers Two-factor authentication (an authenticator app, with backup codes) is switched on under **Settings → Account**. Once it is on, you are asked for a code **after signing in with your password**. It is not asked for after the other methods. A sign-in link, a Google or GitHub sign-in and a passkey each sign you in without the authenticator code. The password-reset link also arrives by email. In practice this means that, by default, anyone who can read your mailbox can use an emailed link to get into the account, even with two-factor authentication enabled. If that matters for your account, switch the emailed links off. ## Switching off emailed sign-in and reset links Under **Settings → Account** you will find **Emailed sign-in and reset links**. It shows **Allowed** by default. Choose **Switch off** to change that. ### Before you can switch it off The account needs both of these first: - **a password**, and - **two-factor authentication enabled**. You are also asked for your **current password** to confirm the change. ### What changes while it is off - **No sign-in link is sent** for the account. The sign-in page answers the same way as before, but no email arrives. - **No password-reset link is sent** either. - **Links already in your mailbox stop working** when you switch off. - **Google and GitHub sign-in are refused**, both for a provider you had linked earlier and for linking a new one. A linked provider is not removed: it works again if you allow emailed links again. - **Your other sessions are ended** when you switch off. Other browsers and devices have to sign in again; the one you are using stays signed in. - **Two-factor authentication cannot be disabled, and the password cannot be removed**, while emailed links are off. You then sign in with your **password and authenticator code**, or with a **passkey**. ### Getting back in if something is lost Read this before you switch off, because the usual safety net (a link to your mailbox) is exactly what you are removing. - **Lost your authenticator?** Sign in with your password and one of your **backup codes**. Keep the codes somewhere safe; without them a lost authenticator locks you out. - **Forgot your password?** It cannot be reset by email. If you have a **passkey**, sign in with it. If you do not, there is no way back in that you can use yourself: you will need to contact [support@emailconnect.eu](mailto:support@emailconnect.eu). Registering a passkey before you switch emailed links off gives you a second way in that does not depend on remembering the password. ### Allowing emailed links again Choose **Allow again** in the same place and enter your current password. Sign-in links, password-reset links and Google or GitHub sign-in work as before from that moment. ## Repeated sign-in attempts Sign-in is limited to slow down password guessing. After 10 wrong passwords for one address within 15 minutes, password sign-in for that address answers "too many requests" until the 15 minutes have passed. One network can make 20 sign-in, link or reset requests per 15 minutes. Very fast repeats, more than 3 in 10 seconds, are refused for a few seconds. The emailed sign-in link, password reset, passkeys and Google or GitHub sign-in are not blocked by wrong passwords for your address. ## API keys are separate None of this affects API keys. They keep working as they did, and the setting itself can only be changed while signed in to the dashboard, not with an API key. ## Related topics - [Passkeys](https://emailconnect.eu/help/passkeys/) — sign in with a fingerprint, face, PIN or security key - [API keys & integrations](https://emailconnect.eu/help/api-keys-integrations/) — programmatic access and scopes