Profile, contact methods, and sign-in
Profile and time zone
Section titled “Profile and time zone”Open Settings → Profile to update your name when the deployment allows it. Managed identity providers can make names read-only.
You can inherit the organization time zone or select a personal one. Your personal selection controls display and notification-template timestamps; it does not alter on-call schedule rules.
Account email
Section titled “Account email”Firewatch uses the account email for invitations, account-security mail, email alerts, and exact-email Slack mapping.
The self-hosted bootstrap administrator does not need an email-verification round trip. Other registration modes and managed deployments can require verification.
Phone number
Section titled “Phone number”When Twilio is enabled, add an E.164 phone number such as +12025550123.
Firewatch sends a verification code before the number becomes eligible for
incident SMS or voice delivery.
Only a confirmed number is used. Removing it disables both phone channels for your account. Voice delivery also depends on the deployment-wide incident voice setting and may be disabled even when SMS is available.
Passkeys
Section titled “Passkeys”Passkeys provide phishing-resistant passwordless sign-in through WebAuthn. Firewatch supports up to ten named passkeys per account. You can add, rename, and remove them under Settings → Authentication.
A passkey-only account cannot remove its final passkey. Keep at least two on separate devices when possible. Removing a passkey from Firewatch does not remove the corresponding credential from the device or password manager.
Passkeys require HTTPS except for the browser’s special localhost development
case. Changing a self-hosted installation’s WebAuthn RP ID makes passkeys
registered under the old ID unusable.
Passwords and two-factor authentication
Section titled “Passwords and two-factor authentication”Accounts allowed to use local authentication can set or change a password. Firewatch supports authenticator-app TOTP as a second factor and issues recovery codes when TOTP is enabled.
Store recovery codes outside the device that holds the authenticator. Each code is single-use. Disabling TOTP requires the current password.
Enterprise SSO policy can disable local passwords, passkeys, TOTP, and recovery codes for an organization.
Recovery limitation
Section titled “Recovery limitation”General email account recovery is not implemented yet. Do not assume that an SMTP configuration provides a forgotten-password flow. Keep multiple passkeys, recovery codes, or an administrator-controlled identity-provider recovery path appropriate to your deployment.