Confirming sensitive actions
Prove it’s still you before Elaichi lets through changes that could lock you out or revoke access. Being signed in isn’t enough for those actions — a Confirm it’s you dialog asks again.
This protects the account itself. If someone walks up to an unlocked laptop, they still can’t disable your two-factor authentication or quietly revoke a token.
Where to find it: Appears automatically when you start a sensitive change (for example under Settings → Security or Settings → API tokens).
Actions that require step-up
Elaichi requires a fresh confirmation for exactly these actions:
| Action | When you see it |
|---|---|
| Revoke an API token | Settings → API tokens → Revoke |
| Disable two-factor authentication | Settings → Security → Disable two-factor authentication |
| Regenerate recovery codes | Settings → Security → Regenerate recovery codes |
| Add a passkey | Settings → Security → Add passkey |
| Delete a passkey | Settings → Security → delete on a passkey |
| Delete your final passkey | Same delete flow when it would remove your last passkey — confirmation must use TOTP (enable two-factor authentication first if you don’t have it) |
No other Settings actions use this prompt today.
Confirm with a second factor
The dialog uses whichever second factor you have:
- With a passkey — your browser or device prompts you (except when deleting the final passkey, which requires TOTP). If the prompt doesn’t appear, or you dismiss it, choose Try passkey again.
- With an authenticator app — enter the current six-digit code, or one of your recovery codes (when TOTP verification allows either).
Once confirmed, the change goes through immediately. Cancelling leaves everything exactly as it was. A successful confirmation is short-lived and covers that one action only.
Good to know
- Doing two sensitive things means confirming twice.
- If you haven’t set up a second factor yet, Elaichi asks you to enroll first — see Secure your account.
- A wrong or expired code fails; try again with a fresh one.
- Recovery codes used here are single-use, same as at sign-in.
- This flow only works in a normal browser session — not via API tokens.