Your account
Sign up and sign in, keep your account secure, and manage your profile, invitations, notifications and personal API keys.
Your account is you, not your company. One account can belong to several organizations, and to single projects in other organizations as a guest. Everything on this page is about your own account: nobody else can see or change your sessions, keys or preferences, and you cannot see theirs.
You reach the account pages from the menu under your name. The left-hand menu has two groups:
- General: Profile, Organizations, Invitations, Notifications.
- Security: Authentication, Sessions, API keys, Linked accounts.
Who can do what
Almost everything here is the same for everyone, because it is your own account. The differences come from the organizations you belong to.
| Task | Who |
|---|---|
| Sign up, sign in, reset a password | Anyone with an email address |
| Edit your profile, language, notifications | You, for your own account |
| Turn two-factor authentication off | You, unless an organization you belong to requires it |
| Accept or decline an invitation | The person the invitation was sent to, once their email is confirmed |
| Open an organization from Organizations | Owners and admins of that organization |
| Create an organization | Platform admins only |
| Create personal API keys | Any signed-in user, for organizations and projects they can see |
If you sign up and see no organization, that is expected: you join one by accepting an invitation.
Sign up
You cannot sign in until your address is confirmed. If you try anyway, the sign-in is refused and a new confirmation link is sent, so an expired link is never a dead end.
Passwords that appear in known data breaches are refused, on sign-up and whenever you change or reset your password. Pick another one.
The language you choose on the sign-in page becomes your account's language.
Sign in
Signing in with a passkey. If you have added a passkey (see Passkeys), select Sign in with a passkey, or pick it from the suggestions your browser shows under Email, and confirm with your fingerprint, face or device PIN. You are signed in straight away, with no verification code.
If you were following a link when you were asked to sign in, for example an invitation email, you land back on that page afterwards.
Signing in with Autodesk or Procore. If your deployment has these configured, the sign-in and sign-up pages show Continue with Autodesk or Continue with Procore. You sign in with that provider and come back signed in here.
Single sign-on
Some organizations sign their people in through their own identity provider. When you type an email address whose domain belongs to such an organization, the password box disappears and the page says that your domain "signs in through its own identity provider". Select Continue with single sign-on and finish at your company's sign-in page.
If your company's provider is not working, select Sign in with a password instead. This only helps if your account has a password.
People who sign in through an organization's identity provider for the first time join that organization as a member. An owner or admin can change the role later. Setting up single sign-on is done by owners and admins in the organization's security settings, see Organizations.
Forgot your password
The page says a link is on its way whether or not an account exists for that address. If the link has expired, the page tells you so and offers Request a new link.
Two-factor authentication
Two-factor authentication asks for a code from an authenticator app (Google Authenticator, 1Password, Authy and similar) after your password.
Turn it on
Sign in with it
After your password you see Two-step verification. Enter the six digits from your app; the form submits by itself on the last digit. Tick Trust this device for 60 days if you do not want to be asked again on this device.
If you do not have your phone, select Email me a code instead. A code is sent to your email; it works once and expires after a few minutes. Send another code sends a fresh one.
If you cannot get a code either way, select Use a recovery code and enter one of the Recovery codes you saved when you turned two-factor authentication on. Each code works once. Use my authenticator app takes you back to the app code.
Recovery codes are only shown when you turn two-factor authentication on. To get a new set, for example when you have used most of them, turn it off and on again; that is not possible while an organization you belong to requires it. If you have lost your phone, cannot open your mailbox and have no recovery code left, nobody in your organization can turn two-factor authentication off for you: send an email to support. When your installation has a support address, the two-step page shows it under the other options.
Turn it off
Select Disable and confirm your password. If an organization you belong to requires two-factor authentication, there is no Disable button: the page says it cannot be turned off.
When an organization requires it
An organization's owners and admins can require two-factor authentication for all members. Until you set it up, that organization and its projects stay closed to you. Its pages point you to Authentication, which repeats why at the top. Your other organizations are not affected.
Passkeys
A passkey lets you sign in with your fingerprint, face or device PIN instead of a password. It lives on your device or in your password manager (iCloud Keychain, Google Password Manager, 1Password and similar), and nothing secret is sent to Gamma. Because the passkey checks that it is you, it signs you in without a verification code.
Adding a passkey needs a recent sign-in. If you signed in more than a day ago, you are asked to sign in again first.
The list shows each passkey's name, when it was added, and whether it is Synced (available on your other devices through your password manager) or on One device. Rename changes its name; Delete removes it from your account. Remove it from your device or password manager too, or it will keep being offered and refused.
A passkey has to confirm it is you with a PIN or biometric. A security key that only needs a touch is refused.
Passkeys and two-factor authentication
A passkey does not replace two-factor authentication. If an organization you belong to requires two-factor authentication, keep it turned on: your password still works, and the requirement protects that way in too.
Change your email address or password
Both are under Account → Authentication.
Email. Enter the New Email Address, and your Current Password if your account has one (an account that only signs in through an identity provider or single sign-on has none), then select Send confirmation. A link goes to the new address. Your account keeps the old address until you open it.
Password. Enter your Current Password, then the New Password twice, and select Update Password. Changing your password signs you out on every other device.
Your profile
Account → Profile shows:
- Profile Photo: PNG, JPEG or WebP, up to 2 MB. Your initials are shown until you upload one.
- First Name and Last Name.
- Email Address: shown here, changed under Authentication.
- User Tag: a short handle, up to 25 characters, unique across the platform.
- Language: the app, your emails and your exports use this language. There are 12 to choose from. Until you pick one, the app follows your browser.
- Chart colours: the colours every chart uses to tell its series apart. Colour-blind safe is the default and stays readable with the common kinds of colour blindness; High contrast separates them more strongly; Classic keeps the earlier colours. Each option shows its colours, and only your own view changes.
Select Save changes after editing your name or tag. The language, chart colours and photo save as soon as you change them.
Delete your account
Under Danger Zone, select Delete Account, then Send confirmation. Nothing is deleted until you open the link in the email Confirm your account deletion. The link expires in one hour. Following it removes your account and its data for good.
If you get that email and did not ask for it, do not open the link. Someone has access to your account: change your password.
Sessions
Account → Sessions lists every device signed in to your account, with the browser, operating system and IP address, most recently used first. Your current one is marked This device.
- Revoke signs out one other device straight away.
- Sign out others signs out every device except this one.
To end the session you are using, sign out.
Linked accounts
Account → Linked accounts lists the sign-in providers your deployment offers, such as Autodesk or Procore, and whether each is Connected.
- Connect sends you to the provider to link it to your account. The provider's email address does not have to match yours.
- Disconnect removes the link.
You always keep at least one way to sign in: your last remaining sign-in method shows Only sign-in method and cannot be disconnected. Your password counts as one.
A link made through an organization's single sign-on shows the organization's name and logo and the label Single sign-on.
Invitations
When someone invites you, you get an email with an Accept invitation button. There are two kinds:
- An invitation to an organization. You join as the role the invitation names: owner, admin or member.
- An invitation to a project. You become a guest of that one project. You cannot see anything else in the organization.
Invitations expire after 48 hours.
Accept or decline
After accepting a project invitation you land on that project. After accepting an organization invitation, you land on your organizations.
Account → Invitations has two lists: Waiting for you, with Accept and Decline on each, and History, with invitations you accepted or declined and ones that expired or were cancelled.
Some things to know:
- You have to confirm your email address before you can see or accept invitations.
- If you are signed in with a different address than the invitation's, the page says so. Select Sign out, sign in with the right address, and you come straight back to the invitation.
- Declining cannot be undone. Someone has to send you a new invitation.
Your organizations
Account → Organizations lists every organization you belong to, with your role in each. The one your session is using is marked Active. Owners and admins see an Open button that takes them to the organization's pages.
The notification panel
The bell at the top of every page opens your notifications. The number on it is how many you have not read yet. On a computer the panel opens under the bell; on a phone it slides up from the bottom of the screen.
You get a notification when:
- an issue or a form is assigned to you;
- a form is sent to you for review, or a form you submitted is approved or rejected (with the reason);
- you are invited to an organization or a project, if you already have an account;
- your export is ready to download, or could not be made;
- as an organization owner or admin, someone changes where the organization stores its files.
Select a notification to go to what it is about; that marks it read. The button on each one marks it read or unread again, Mark all as read clears the count, and Show older loads earlier ones. Notifications are written in your language and are kept for 90 days.
Nobody is notified about their own changes. Which project events reach you, and how often you are also emailed about them, is set per project by its admins: a type set to Never does not appear in the panel either, and for the other choices the panel shows it straight away while the email may wait for a digest. See Projects.
Notifications
Account → Notifications controls how emails reach you. The notification panel itself has no settings here:
- Time zone: when hourly, daily and weekly digests are sent. If you have not set one, the page suggests your browser's. Without one, a project's own time zone is used, then UTC.
- Product news: occasional emails about new features.
- Email security code: a phrase of your own, 4 to 32 letters, digits, spaces or hyphens. It is printed in every email the platform sends you. An email that claims to be from us but does not show it is not from us.
Select Save changes. Which project events you hear about, and how often, is set per project, see Projects.
Personal API keys
Account → API keys is where you create keys for scripts and integrations. A key acts as you, but only in the organizations and projects you choose and only with the permissions you give it (No access, Read or Write per area). It never does more than you can do yourself.
You can hold up to five keys. A key unused for 180 days is revoked automatically and you get an email about it. Each key keeps a history of who created, changed or revoked it. For how to use a key, see API keys.
Good to know
- Emails you can receive about your account: email confirmation, password reset, sign-in code, account deletion confirmation, invitations, and an API key being revoked for inactivity. Each is written in your account's language and shows your email security code if you set one.
- Changing your email address sends a link to the new address only. Nothing is sent to the old one.
- The API for all of this is in the Profile picture, Sessions, Notifications, Preferences, Invitations, Two-factor authentication and Passkeys sections of the API reference.
Related pages
Everyday use
How Gamma is put together, who does what, and the tasks most people do every day — with a link to the full page for each area.
Dashboards and widgets
Build your own charts, numbers and lists from the platform's metrics, and arrange them on your home page, a project, an organization or the admin panel.