Quillet
Menu
Menu

Your account

5 min read

Your Quillet account is you in every project you belong to: this guide covers how you sign in, what the Account page holds, and when a content manager needs a personal token.

Why the dashboard needs to know who you are

The dashboard needs to know who you are. It decides what you may do in each project from your role there. It writes your name on every version you save, so History can say who changed what. And your account owns anything done in your name outside the dashboard.

That last part is what a personal token is for. Most content managers never need one. The dashboard signs you in with a session, your site reads content with a delivery key of its own, and engineers' scripts use keys that belong to the project. A token is for the rare case where a tool outside the dashboard has to act as you, with your rights. Because a token is you, it is worth knowing exactly what one can do before you make one. Access compares every kind of credential.

What your account holds, from sign-in to tokens

Signing in

Depending on how your instance is set up, the Sign in page offers one or more of these:

  • Email and Password.
  • Continue with GitHub, for members of the GitHub organisations your instance allows.
  • Continue with Google, for accounts in the Google domains your instance allows.

Say you already have an account with a password, and you then use Continue with GitHub or Continue with Google with the same verified email address. You are signed in to that same account, and from then on either way works. An account that was first made with GitHub or Google has no password.

Signing in with GitHub or Google checks your membership every time. If you leave the organisation or the domain, you can no longer sign in that way.

The account menu and the Account page

The round button with your initials, at the right of the header, shows your name and email, then Account and Sign out. Account opens a page that says "Signed in as" and your email. The page holds one setting: Personal access tokens.

Personal access tokens

A token lets the command line, or another tool, sign in as you. For as long as it lives, it acts with your role in every project you are a member of. It cannot sign in to the dashboard. Nor can a token make its own replacement: only you, signed in, can create or revoke tokens, create a project, list your projects or list a project's members, and a token is refused all of those.

Each token has a Name you choose, an id that starts with qt_, and a secret that is shown once, when you create the token. The list shows each token's Name, Created, Last used and Expires, with Revoke at the end of the row.

When a content manager needs one

You need a token in either of these cases:

  • An engineer has set up a command or a script that should run as you, such as one that pulls the project's content into a repository you work in.
  • You use the command line yourself.

You do not need one to work in the dashboard, to publish, or for your site to read content.

How to

Create a token

  1. Open the account menu and choose Account.
  2. Press New token.
  3. In Name, say where you will use the token, such as "laptop".
  4. In Expires, keep 90 days unless you have a reason to change it. The other choices are 30 days, A year and Never.
  5. Press Create token.
  6. Your new token shows the secret, once. Press Copy and paste it straight into the tool that needs it, or into a password manager.
  7. Press I have copied the secret. After that, the secret cannot be shown again.

Revoke a token

  1. On Account, find the token by its name.
  2. Press Revoke.
  3. Read Revoke this token? and press Revoke token. From that moment, anything still using the token is refused, and the row reads Revoked.
  4. If someone else may have seen the token, tell the project's owner. Revoking stops the token, but it does not undo what was done with it while it worked, such as keys it created or members it added.

Sign out

  1. Open the account menu.
  2. Choose Sign out.

Get into another project

  1. Ask the project's owner to add you. The owner needs the email address you signed up with, and chooses your role in Settings → Members: a viewer reads content and history, an editor writes and publishes, and an owner can do everything, including keys, members and the project itself.
  2. Open the project from All projects, or from the project switcher in the header.

Limits

  • The Account page has no way to change your name, email or password, and the Sign in page has no "forgotten password" link. For any of those, ask the engineers who run your instance.
  • You cannot unlink GitHub or Google from an account, or turn the password off for an account that has one.
  • Access through GitHub or Google follows organisations and domains only, not GitHub teams or Google groups. People outside the allowed organisations or domains cannot be invited through them. They need a password account, if your instance allows sign-up.
  • A token cannot be limited to one project or to some rights: it always carries your role in every project you belong to. Prefer a short expiry.
  • Nobody else, not even a project's owner, can see or revoke your tokens. Only you can, from your Account page.
  • A token cannot sign in to the dashboard. It is for the command line and the API.

Last updated