What protects access to your account is in “Settings” › “Account and security”, under “Your profile”. Open the page from the account menu › “Settings” › “Account and security”, or at chat.realmoon.ai/settings/account#security.
| Section | To |
|---|---|
| “Email address” | Change your account’s address |
| “Password” | Change your password, or set one if you sign in with Google, Apple, Microsoft or GitHub |
| “Passkeys” | Sign in without a password, by unlocking your device |
| “Two-factor authentication” | Ask for a code in addition to your password at each sign-in |
| “Connected accounts” | Link or remove Google, Apple, Microsoft or GitHub |
| “Connected devices” | See where Moon AI is open and sign out a device |
| “Moon CLI sessions” | Revoke access for a terminal signed in with moon login |
| “Moon AI for Chrome” | See the browsers where the extension is connected to your account, and close a connection with “Disconnect” |
| “Recent activity” | Review the security changes on your account |
The same page then holds “API keys”, “Discord” and “Account management”.
Change your email addressLink to the Change your email address section
- In “Email address”, click “Change email”.
- Enter the “New email address” and your “Current password”.
- Click “Send verification code”. A 6-digit code, valid for 15 minutes, goes to the new address; a security alert goes to the old one.
- Enter the “Verification code”, then click “Confirm and sign out”.
- Sign in again with the new address.
All your devices are signed out after the change. If you only sign in with Google, Apple, Microsoft or GitHub, set a password first (see below): you need it in step 2.
Change your passwordLink to the Change your password section
- In “Password”, open “Change password”.
- Enter your “Current password”, the “New password” and “Confirm password”.
- Check that all five rules are ticked (at least 12 characters, one uppercase letter, one lowercase letter, one number, one special character).
- Click “Update password”.
Your other devices are signed out; this one stays signed in (“Password changed. Your other devices were signed out.”). If you forgot your password, use “Forgot?” on the sign-in page: see Forgot your password.
Set a password for a Google, Apple, Microsoft or GitHub accountLink to the Set a password for a Google, Apple, Microsoft or GitHub account section
An account created with an external provider has no password. You can add one, to also sign in by email or to remove the provider later.
- Click “Set a password” (in “Password” or “Email address”).
- Click “Send code”: a 6-digit code, valid for 15 minutes, goes to your account’s address.
- Enter the “Code received by email”, the “New password” and “Confirm password”.
- Click “Set password”.
Your other devices are signed out, and a “Password set” email confirms it.
Turn on two-factor authenticationLink to the Turn on two-factor authentication section
Two-factor authentication (2FA) asks for a code in addition to your password at each sign-in. Two methods are available.
| Method | How the code arrives | Note |
|---|---|---|
| “Authenticator app” (“Recommended”) | An authenticator app (Google Authenticator, Microsoft Authenticator, your password manager…) generates a 6-digit code | Works offline; your current password is asked when you turn it on |
| “Email” | A code is sent to your address at each sign-in, valid for 5 minutes | Depends on access to your mailbox |
With an authenticator appLink to the With an authenticator app section
- In “Two-factor authentication”, click “Enable 2FA”, then choose “Authenticator app”.
- Scan the QR code with your app. On a phone, “Open in authenticator app” does it for you; otherwise, “Or enter this key manually” gives you the key to type in.
- Enter the 6-digit code shown by the app and your “Current password”, then click “Verify”.
- Save your backup codes (see below).
By emailLink to the By email section
- Click “Enable 2FA”, then choose “Email”.
- Enter the code you received by email, then click “Verify”.
- Save your backup codes.
Once it is on, your other devices are signed out (“Two-factor authentication enabled. Your other devices were signed out.”). The section then shows “Enabled”, the method and the date it was turned on.
Backup codesLink to the Backup codes section
Backup codes replace the 2FA code if you lose your phone or access to your mailbox.
- When you turn on 2FA, Moon AI shows ten codes in the
XXXXX-XXXXXformat, only once: “Save your backup codes”. - Copy them (“Copy all”) or download them (“Download (.txt)”), then store them somewhere other than your phone. Click “I have saved my codes”.
- Each code works only once. The “2FA backup codes” card shows how many are left, and warns you when three or fewer remain.
- “Generate new codes” creates a new set, with your password: the old codes stop working.
To use a code when you sign in, click “Use a backup code” at the 2FA step.
Turn off two-factor authenticationLink to the Turn off two-factor authentication section
Click “Disable 2FA”, enter your password, then confirm. Your backup codes are deleted and your other devices are signed out.
PasskeysLink to the Passkeys section
A passkey signs you in without a password, with your fingerprint, your face or your device’s lock code. It works on the device where you create it and on the ones your password manager syncs. You need a recent version of Chrome, Safari, Edge or Firefox.
Add a passkeyLink to the Add a passkey section
- In “Passkeys”, click “Add a passkey”.
- Confirm your identity: your password, or failing that a code from your authenticator app or the code of your locked conversations.
- Click “Continue”, then confirm with your device when the browser asks.
“Passkey added.” appears, and a “New passkey added” email lets you know. Each passkey shows when it was created and last used. You can save up to ten.
Rename or delete a passkeyLink to the Rename or delete a passkey section
- “Rename” changes its name (for example, the device’s name).
- “Delete” removes it: “You will no longer be able to sign in with it. Your other ways to sign in stay as they are.”
To sign in with a passkey: “Sign in with a passkey” on the sign-in page. No 2FA code is asked afterward, since the passkey already proves the device is yours.
Connected accountsLink to the Connected accounts section
“Connected accounts” lists the providers you can sign in with (Google, Apple, Microsoft, GitHub), with “Connected” or “Not connected”.
- “Connect” links a provider to your account: “… account linked”. A provider account already linked to another Moon AI account is refused.
- “Disconnect” removes it, after confirmation: you will no longer be able to sign in with it, but you can link it again.
If that provider is your only way to sign in, Moon AI refuses to remove it (“This is your only way to sign in. Set a password first.”) and offers “Set a password”.
Devices and sessionsLink to the Devices and sessions section
“Connected devices” lists the devices where Moon AI is open right now: browser and system (“Chrome on Windows”, for example) or mobile app, when it was opened and the IP address. The device you are using is marked “This device”.
| Action | Effect |
|---|---|
| “Sign out device”, on a device | That device will have to sign in again; the others stay signed in |
| “Sign out other devices” | All other browsers, apps and Moon CLI sessions are signed out; this one stays signed in |
| “Sign out from all devices” | All sessions, this one included, are revoked: you will have to sign in again here too |
Devices that are closed but still signed in don’t appear in the list: “Sign out other devices” signs them out too.
Moon CLI sessionsLink to the Moon CLI sessions section
“Moon CLI sessions” appears if a terminal is signed in to your account with moon login. Each session shows when it signed in and when it expires. “Revoke” signs out that terminal; run moon login again to use it. See Moon CLI.
Recent activityLink to the Recent activity section
“Recent activity” lists the last 20 security changes on your account, newest first, with the date, the device and a partly hidden IP address. A badge shows when the change didn’t come from you: “By an administrator”, “By the previous owner” or “By someone else”.
It includes, among others: “Password changed”, “Password set”, “Email changed”, “2FA enabled”, “2FA disabled”, “2FA backup codes regenerated”, “Personal API key created”, “Personal API key deleted”, “Signed out from all devices”, “Other devices signed out”, “Device signed out” and “Linked account removed”. Sign-ins themselves are not listed.
Security alerts by emailLink to the Security alerts by email section
Moon AI emails you when these changes happen:
| Event | Recipient | Email subject |
|---|---|---|
| Address change requested | The old address | “E-mail change requested” |
| Address changed | The old address | “E-mail address changed” |
| Password set on an account without one | Your address | “Password set” |
| Passkey added | Your address | “New passkey added” |
| New Moon CLI sign-in | Your address | “New Moon CLI sign-in” |
| Sign-in to the mobile app with a code shown in the browser | Your address | “New sign-in to the Moon AI app” |
| Account linked from the mobile app | Your address | “Account linked from the Moon AI app” |
| Locked conversations code changed or reset | Your address | “Locked conversations code changed” or “Locked conversations code reset” |
If you get one of these alerts and you didn’t make the change, follow the steps below.
If you think your account is compromisedLink to the If you think your account is compromised section
- Change your password (or use “Forgot?” if you can no longer sign in).
- In “Connected devices”, click “Sign out from all devices”, then sign in again.
- Check “Connected accounts”, “Passkeys” and “Moon CLI sessions”, and remove anything you don’t recognize.
- Turn on two-factor authentication, preferably with an authenticator app.
- Review “Recent activity”, then contact support if anything worries you: Get help.
Moon Blur and locked conversationsLink to the Moon Blur and locked conversations section
Moon Blur and locked conversations are not on this page, but in “Settings” › “Data and privacy”. The “Moon Blur” section reminds you that Moon Blur is always on and manages your own data to mask: see Your own data to mask. The “Locked conversations” section creates or changes the code that protects some conversations: see Manage your conversations.