# Profile, contact methods, and sign-in

> Manage time zones, verified phone numbers, passkeys, passwords, and two-factor authentication.

This is the machine-readable version of this Firewatch documentation page.

## Profile and time zone

Open **Settings → Profile** to update your name when the deployment allows it.
Managed identity providers can make names read-only.

You can inherit the organization time zone or select a personal one. Your
personal selection controls display and notification-template timestamps; it
does not alter on-call schedule rules.

## Account email

Firewatch uses the account email for invitations, account-security mail, email
alerts, and exact-email Slack mapping.

The self-hosted bootstrap administrator does not need an email-verification
round trip. Other registration modes and managed deployments can require
verification.

## Phone number

When Twilio is enabled, add an E.164 phone number such as `+12025550123`.
Firewatch sends a verification code before the number becomes eligible for
incident SMS or voice delivery.

Only a confirmed number is used. Removing it disables both phone channels for
your account. Voice delivery also depends on the deployment-wide incident voice
setting and may be disabled even when SMS is available.

## Passkeys

Passkeys provide phishing-resistant passwordless sign-in through WebAuthn.
Firewatch supports up to ten named passkeys per account. You can add, rename, and
remove them under **Settings → Authentication**.

A passkey-only account cannot remove its final passkey. Keep at least two on
separate devices when possible. Removing a passkey from Firewatch does not
remove the corresponding credential from the device or password manager.

Passkeys require HTTPS except for the browser's special `localhost` development
case. Changing a self-hosted installation's WebAuthn RP ID makes passkeys
registered under the old ID unusable.

## Passwords and two-factor authentication

Accounts allowed to use local authentication can set or change a password.
Firewatch supports authenticator-app TOTP as a second factor and issues recovery
codes when TOTP is enabled.

Store recovery codes outside the device that holds the authenticator. Each code
is single-use. Disabling TOTP requires the current password.

Enterprise SSO policy can disable local passwords, passkeys, TOTP, and recovery
codes for an organization.

## Recovery limitation

General email account recovery is not implemented yet. Do not assume that an
SMTP configuration provides a forgotten-password flow. Keep multiple passkeys,
recovery codes, or an administrator-controlled identity-provider recovery path
appropriate to your deployment.