Account security

Your Annota AI account has no password. You sign in with an email code, a passkey, or a linked Google or GitHub account, and you can review and revoke every place where your account is active.

Open your security settings

Open the menu at the bottom of the sidebar (it shows your organization and email).
Under Account, select Settings.
Select Security.

Sensitive actions, such as adding a sign-in method, changing your email, or deleting your account, require a recent sign-in. If your last sign-in is not recent enough, the app asks you to sign in again and then brings you back.

Method	How it works
Email code	Select Continue with email and enter the 8-digit code you receive. The code expires after 10 minutes.
Passkey	Select Sign in with a passkey and use Face ID, Touch ID, Windows Hello, or a security key.
Google or GitHub	Select Continue with Google or Continue with GitHub.

To add a passkey, select Add passkey under Passkeys. To link a Google or GitHub account, select Connect Google or Connect GitHub under Connected accounts. You can Remove a passkey or Disconnect a linked account at any time; your other sign-in methods stay available.

Annota AI emails you when there is a new sign-in to your account, when a sign-in method is added or removed, and when your email address changes. If you do not recognize the activity, review your sessions and sign-in methods right away.

Change your email address

Next to your email address in Profile, select Change, enter the new address, and select Send verification code. Enter the 8-digit code sent to the new address and select Change email. Nothing changes until the new address is verified.

Browser sessions

Browser sessions lists every browser signed in to your account, with the sign-in method and the last activity. The browser you are using is marked Current. Select Revoke to sign a browser out; it must authenticate again to get back in.

Sessions last at most 90 days and expire after 30 days of inactivity. To sign out of the current browser, open the sidebar menu and select Log out.

Authorized applications

Authorized applications lists the MCP clients, CLI tools, and other applications you have authorized to use your account. Select Revoke access to remove an application’s access, including the tokens it already holds. To connect it again, you must authorize it again.

An authorized application acts with your account and your permissions, and the credits it uses are charged as in the app. Revoke access as soon as you stop using a client or suspect unauthorized use. See Connect with MCP.

Report a security issue

If you notice suspicious access, lose control of a sign-in method, or find a vulnerability, revoke the affected sessions or applications and write to team@annota.ai with what you observed.

Report illegal content

Anyone can report content on Annota AI that they believe is illegal, including copyright infringement, through the illegal content report form. Include where the content is (link or identifier) and why you believe it is illegal. Reports are reviewed by people, and if you give your email you receive a confirmation and the decision.