Account & Security

How you get into Tenbi, how to protect your account with two-factor authentication, what to do when a password is lost, and which emails Tenbi sends you.

Getting in

Tenbi is in an invite-only alpha. Accounts are created from an invite; if you don't have one yet, join the waitlist below.

Accepting an invite

You'll receive an email with the subject You're invited to Tenbi and an Accept invite button. The link opens a page that has already validated your invite and shows You're invited as your email address:

1. Your Email is fixed — it's the address the invite was sent to.
2. Choose a Password (at least 8 characters) and repeat it under Confirm password.
3. Click Create account. Your account and workspace are created and you're signed in immediately, landing on First Steps so you can start setting up.

Invite links work once and expire — the email tells you when. If the page shows "This invite link is invalid, expired, or already used," ask whoever invited you for a fresh invite.

The Terms of Service gate

Before you can use anything, a Before you continue screen asks you to agree to the Terms of Service and Privacy Policy (both linked from the screen, along with how connected credentials are stored). Click Accept & continue to record your acceptance and enter the app, or Sign out if you'd rather not proceed.

You may see this screen again. Your acceptance is recorded against a specific version of the terms. If the terms are ever updated, you'll be asked to accept the new version at your next visit before continuing.

No invite? Join the waitlist

On the sign-in page, click Sign up. While Tenbi is in invite-only alpha the sign-up page is a waitlist — no password is collected:

1. Optionally enter a Workspace name (optional) (leave it blank if you're solo) and your Email.
2. Click Join the waitlist.
3. Answer a short survey — one question per screen, every step skippable via Skip (use Back to revisit).

You'll see "You're on the list" and receive a confirmation email (You're on the Tenbi waitlist). Invites go out in waves — when yours is ready, you'll get the invite email described above and can create your account from it. There's nothing else to do in the meantime.

Bring a Claude credential. Tenbi runs on Anthropic's Claude models — you'll need an Anthropic API key or Claude subscription during onboarding. See First Steps.

Two-factor authentication

Two-factor authentication (2FA) adds an authenticator-app code to your sign-in, on top of your password. It's optional but recommended — your account holds credentials that can reach your repos.

You manage it from your account card at the bottom of the sidebar: click it, choose Account settings, then open the Security pane. The Two-factor authentication section shows a status chip — On or Off.

Turning it on

You'll need any TOTP authenticator app — Google Authenticator, 1Password, Authy, and the like all work.

1. Click Enable two-factor.
2. Confirm your Password and click Continue.
3. Scan the QR code with your authenticator app. Can't scan? Copy the setup key shown next to it (Copy key) and enter it in your app manually.
4. Enter the 6-digit code your app now shows and click Verify & turn on.

Privacy note: the QR code is generated locally in your browser from your setup key — it is never sent to a third-party QR service.

Recovery codes — save them now

Immediately after enrolling, Tenbi shows your recovery codes. Each one signs you in once if you lose your authenticator device. They will not be shown again — store them before clicking Done:

• Copy puts them on your clipboard.
• Download saves them as tenbi-recovery-codes.txt.

Put them somewhere safe that isn't the device running your authenticator app — a password manager is ideal.

Signing in with 2FA on

Sign-in becomes two steps: enter your email and password as usual, then enter the code under Authentication code and click Verify. The prompt accepts either:

• the current 6-digit code from your authenticator app, or
• one of your recovery codes (each works once).

You can type the code with the gap your app displays ("123 456") — spaces are ignored. The challenge is short-lived: it expires after about 5 minutes and allows a handful of attempts, after which you're returned to the password step to start over (Back to sign in takes you there any time).

Regenerating recovery codes

Running low on unused codes, or unsure where they ended up? In Account settings → Security, click Regenerate recovery codes. Confirm with your Password and a current code (or a recovery code) under Authentication or recovery code, then click Regenerate codes. A fresh set is shown once — save it the same way as before.

Regenerating replaces every existing code. Old codes stop working immediately, including unused ones.

Turning it off

In the same section, click Turn off, confirm with your Password and a current code (or a recovery code), and click Turn off two-factor. Your sign-in goes back to password only, and your recovery codes are no longer needed.

Locked out?

• Lost your authenticator device: sign in with one of your recovery codes, then either re-enroll with a new device or turn 2FA off and on again.
• Lost your recovery codes too: contact the operator who invited you. An admin can clear 2FA from your account so you can sign in with your password and enroll again.

Passwords

Forgot your password

On the sign-in page, click Forgot password?, enter your Email, and click Send reset link.

You'll see the same confirmation regardless of what you typed — "If an account exists for that email, a reset link is on its way" — so the form can't be used to probe which emails have accounts. The request is rate-limited; if you see "Too many requests," wait a while and try again.

If your address has an account (and the platform's mailer is configured), an email with the subject Reset your Tenbi password arrives with a Set a new password button. The link works once and expires in 24 hours. It opens a page showing which account it's for:

1. Enter a New password (at least 8 characters) and Confirm new password.
2. Click Set new password. You're signed in right away, and every previous session is signed out.

Admin-issued reset links

If the email never arrives — no mailer configured, or a delivery problem — the operator can issue you a reset link directly. It opens the same reset page and behaves the same way (works once, shows the account it's for). If a reset page says "This reset link is invalid, expired, or already used," ask for a new one.

Changing your password while signed in

In Account settings → Security, under Change password: enter your Current password, a New password (at least 8 characters), Confirm new password, and click Change password.

Changing your password signs out every other session — only the browser you changed it in stays signed in. That makes it the right first move if you suspect someone else has your password.

Active sessions

Also under Security, the Active sessions list shows everywhere your account is signed in — browser, platform, sign-in time, and IP, with your current one tagged This session. Click Sign out on any single session to end it, or Sign out other sessions to end everything except the browser you're in.

Email notifications

Tenbi can email you about run events. Open Settings in the sidebar, then the Notifications pane (Email notifications). These are your personal preferences, sent to your account email — but they cover runs across your whole workspace, not just runs you started:

• Run failed — a run ended in FAILED; the email includes the reason and a link to the record. On by default.
• Pull request opened — a run finished and its PRs are ready for review. Off by default — this can be chatty on busy Lanes.

Toggles save as you flip them. Emails only actually send when the platform mailer is configured — your preferences are saved either way.

Silent-mode Lanes stay silent everywhere. A Lane with silent mode on suppresses these notification emails too, exactly like it suppresses channel messages — email notifications go through the same gate as the Messaging modules.

These per-user emails are separate from channel notifications: Discord/Slack messages about a Lane's runs are configured per-Lane via Messaging modules, and reach a channel rather than your inbox.