You can protect your Fluxer account with a second factor on top of your password, and see and sign out every device where you're signed in. Two-factor authentication is under "Security" in "Account" in "User settings", and your devices are under "Linked devices".
Which two-factor methods does Fluxer support?
You can use an authenticator app, a passkey or a security key as your second factor, and two-factor authentication also gives you backup codes. Backup codes still work if you lose your authenticator app or your passkey, and you should keep them somewhere safe away from the device you sign in on. You can also sign in to Fluxer with a passkey.
I lost my authenticator app or passkey. How do I get back in?
Sign in with one of your backup codes. If you've lost every second factor and have no codes left, email support@fluxer.com from your account's email address, and a person on our team will help you get back in. On a self-hosted instance, its admin can help you.
Why does Fluxer ask me to confirm it's you again?
Before some sensitive changes, Fluxer asks you to confirm it's you, even on a device where you're already signed in. That includes changing your password or email, managing two-factor authentication and passkeys and signing out other devices. It also includes deleting your messages in bulk, disabling or deleting your account, deleting a community, transferring community ownership and resetting a bot token.
If you have two-factor authentication turned on, you confirm with your second factor or a backup code, and your password alone isn't accepted. If you don't, you confirm with your password, or with a code we email you if your account has no password. After you confirm, you can make more of these changes for 5 minutes without being asked again. There's no setting to choose which of these changes ask you to confirm.
How long does a Fluxer sign-in last?
You stay signed in on a device until you sign out on it or sign it out from "Linked devices" on another device. Changing or resetting your password also signs out your other devices, and disabling or deleting your account signs you out everywhere.
Treat your token like your password, and only ever paste it into scripts and tools you wrote or fully trust. Fluxer never asks for your password by email.
How do I sign out my other devices on Fluxer?
Changing or resetting your password signs out your other devices, and you can also sign out one device or all of them from "Linked devices" in "User settings".
Why does claiming a gift on Fluxer need a captcha?
When you claim a gift from someone, Fluxer asks for a captcha and not for a two-factor code. Your device works out a small math problem for you, so you don't have to click through a puzzle, and Fluxer doesn't use an outside captcha service.
Does Fluxer have SMS two-factor authentication?
No, Fluxer doesn't offer two-factor authentication by text message. Section 7.2 of our privacy policy says the record kept from phone verification is never used for it.
How do I report a security vulnerability?
Email security@fluxer.com and follow the steps in our security policy.