Account security

Open the user menu (your initials), then select Security. For a direct email and password account, this page has Email address, Password, Two-step verification and Signed-in devices.

Every direct sign-in needs a second step after the password. Without a saved method, Set up two-step verification opens right away, with no skip. Brightspace launches and embedded widgets do not ask for a second step. For an account created by a Brightspace launch, Security instead says You sign in through Brightspace, which protects your sign-in. and shows Signed-in devices.

Set up your second step

Choose Set up a passkey or Set up an authenticator app on the first sign-in. You can add the other method later from Security. Setting up both gives you another way in if you lose one.

Authenticator app

On first sign-in, select Set up an authenticator app. On Security, select Set up authenticator app under Authenticator app and enter Current password.
Select Continue, then scan the QR code with your authenticator app. If you cannot scan it, open Can’t scan it? Enter this key and enter the key in your app. Copy key copies it for you.
Enter the app’s current 6-digit code in Code from your authenticator app, then select Confirm code.
If Save your backup codes appears, save the codes as described below. On first setup, select Continue to Rowseta after saving them.

On later sign-ins, enter the current 6-digit code and select Verify. An already-used code is refused. Wait for the next code in your authenticator app and use that one.

Passkeys

On first sign-in, select Set up a passkey. On Security, select Add a passkey under Passkeys and enter Current password.
Enter a Passkey name, select Continue, and follow your browser or device prompt to save the passkey and verify it is you. Set it up at the Rowseta address where you will use it; a passkey is specific to that Organization address.
Save any backup codes shown. On first setup, select Continue to Rowseta after saving them.

At later sign-ins, select Use your passkey after the password. If your browser does not support passkeys, use your authenticator app, a backup code or another browser.

On Security, Rename changes the passkey’s Passkey name in Rowseta; select Save. The tip below the list says: Your password manager may show the email you had when you saved the passkey. You can rename it there; it still works.

Backup codes

Your first method comes with 10 single-use backup codes. Save your backup codes shows them only once. Select Copy or Download .txt, keep them somewhere safe, then check I saved my backup codes. Select Continue to Rowseta during first setup, or Done from Security.

To sign in with one, select Use a backup code, enter it in Backup code, then select Verify. With 3 or fewer remaining, sign-in warns you to get new ones from Security. The Backup codes section also warns when 3 or fewer remain and shows how many are left out of 10.

To replace the set, select Get new codes, enter Current password, then select Get new codes again. Old codes stop working immediately. Save the new set, check I saved my backup codes, then select Done.

Remove a method

Use Remove authenticator app or Remove beside a passkey. Enter Current password and select Remove. You must keep at least one authenticator app or passkey; backup codes do not count as a method. Add another method before removing your last one.

Adding or removing a method signs out your other sessions and keeps this one. You receive email notices when methods are added or removed and when new backup codes are created.

Change your email

Under Email address, select Change email. A second step must already be set up.
Enter New email and Current password. Under Second step, choose Passkey, Authenticator app or Backup code from the available choices.
For an app or backup code, enter the code and select Send confirmation link. For a passkey, select Use passkey and change email and follow the prompt.
Check the new address for Confirm your new email address. Within an hour, select Confirm new email in the email, then Confirm new email on the page.
Sign in again with your new email address and existing second step. Your old address receives notice of the requested change; the new address receives confirmation after the change.

Change your password

Under Password, select Change password. Enter Current password and a New password of at least 12 characters, then select Save. This browser stays signed in; your other sessions end. A password reset ends all sessions. Both retire outstanding password reset, invitation setup and activation links.

Signed-in devices

This card lists browsers signed in to your account, with browser and operating system, Signed in time, Last active, and Through Brightspace or Signed in with password. This device marks the current browser. No IP address or location is shown.

Select Sign out beside another browser to end that session.
Select Sign out everywhere else, then Sign out other devices in Sign out of all other devices? to end your other sessions. This browser stays signed in.
To sign out this browser, use Sign out in the user menu.

Other browsers need to sign in again on their next action. If you do not recognize a browser, sign it out and change your password. If someone uses Sign out everywhere on your account in People, your sessions end and your next action asks you to sign in again.

App sessions, including Brightspace launches, end after 60 minutes without activity and at most 12 hours after sign-in. Real clicks, key presses, touches and wheel scrolling on a visible Rowseta page count as activity; idle tabs and background updates do not. The Are you still there? warning offers Stay signed in before idle sign-out. It cannot extend the 12-hour maximum. See Idle sign-out and session limits for the end-of-session messages.

After a completed password and second-step sign-in from a browser Rowseta does not recognize, you may receive New sign-in to your Rowseta account. It includes your Organization, time, browser and operating system. If it was you, no action is needed. Otherwise, use Reset your password and contact your administrator.

The first browser and recognized browsers do not trigger this email. Brightspace launches do not trigger it. Notices are limited to one per 10 minutes and five in a rolling 24 hours, so an email is not sent for every new browser sign-in.

Lost your phone or passkey

Try another saved method or a backup code first. If none works, select Can’t use any of these? after entering your password.

If the page directs you to ask for a reset, contact your Organization administrator and point them to People. After Reset two-step verification, you receive Two-step verification reset, all your sessions end, and your next password sign-in asks you to set up a new second step and save new backup codes.

Recover by email

Email recovery is offered only when nobody else in the Organization is eligible to reset your second step. If your email changed within the last 7 days, the page instead shows when email recovery opens.

Select Email me a recovery link when offered.
Open Confirm your recovery request and select Start recovery within an hour. On the page, select Start recovery again. Opening the email link alone does not start the wait.
Wait 3 days from that confirmation. The emails Your recovery wait has started and Your recovery wait ends soon include Cancel recovery.
After Your recovery is complete, sign in with your password, set up a new second step and save new backup codes. Recovery ends your old sessions.

To cancel, use Cancel recovery from a recovery email, then select Cancel the recovery request on the page. Signing in successfully with an existing second step, including a backup code, also cancels recovery. Changing your email cancels it. Recovery is also cancelled if your account is suspended, no longer has a password, or an eligible reset administrator is found when the request is processed. An administrator reset removes the open request.

Only one recovery request can be open at a time, with at most 3 requests in 30 days. An unconfirmed start link expires after an hour without starting the 3-day wait.