When an account is needed
Direct native SSH does not require an LeapTerm account just to connect. Managed relay and cloud-account workflows require their own authenticated access, including when a free allowance is offered.
Managed LeapTerm account requests use https://api.leapterm.com, and managed passkeys use the leapterm.com relying party. Self-hosted deployments use their configured account service and passkey policy. Passkey availability depends on the device, browser and deployment.
Choose a sign-in method actually offered by your deployment: email and password, a passkey, a configured provider such as Google or Apple, or an enabled email-code workflow. A method shown in a guide is not proof that every administrator has configured it.
Sign in
- Open the sign-in flow and choose an available method.
- Complete any requested security check and the password, provider, passkey or email verification prompt for the intended account.
- If two-factor protection is enabled, enter the authenticator code or an unused two-factor backup code.
- Wait for the completed sign-in state. Passing the first step alone is not a full login when a second factor is required.
- Unlock the relevant vault separately when its workflow asks you to.
Use the original sign-in method for an existing account. A matching email address from another provider does not automatically prove that the identities should be linked.
If the app offers Sign in with passkey after checking your email, complete that prompt or use Use password instead if this account has a password.
Create an email-and-password account
- Choose Create account, enter your email and a strong, unique password, and complete the requested security check.
- Check your inbox for the verification code. Enter it under Email code and choose Verify email code.
- Wait for completed account creation and sign-in. Requesting the code leaves registration pending; it does not create a signed-in session. Use Change email or restart the flow if you need a fresh challenge.
Email delivery and account registration must be available in the deployment. Adding a password to an existing account requires proof of ownership; creating another account with its email is not a shortcut.
Set up an authenticator
Open Account security from the available account controls. If prompted, add a passkey before changing sensitive security settings. Choose Set up authenticator, scan the displayed setup information in your authenticator app, and enter its current code under Confirm authenticator.
Save the backup codes privately when shown. Each works once after the primary sign-in step; they are not vault recovery keys. Confirm that you saved them before leaving the screen.
Activating two-factor protection signs out previous sessions. Sign in again and complete both steps to check your setup. If authenticator operations are unavailable, contact the service operator instead of repeatedly retrying setup.
Understand the recovery materials
| Material | Purpose |
|---|---|
| Two-factor backup code | Completes the second factor after a successful primary sign-in. Each code is single-use. |
| Account recovery code | Restores a supported lost-sign-in workflow and can revoke old sign-in methods and sessions. It does not decrypt a vault. |
| Vault recovery material | Supplies the separate authority required to recover protected vault data. Keep what your specific workflow requires. |
Use Create recovery code where available, save it when displayed, and note its stated validity. Do not assume an old code remains reusable after recovery or expiry.
Review signed-in devices
In Account security, inspect Signed-in devices. Use Sign out device for an unfamiliar session or Sign out all devices when appropriate, and check the result. Disabling an authenticator is also a sensitive operation, not a routine fix for a failed login.
For an email-and-password account, choose Forgot password?, complete the requested security check, and enter the emailed reset code and a new password. Then sign in again and complete any required second factor. Resetting the account password invalidates previous sessions.
An account that uses only Google or Apple must sign in with that provider; reset its provider password there. An account-password reset does not decrypt an existing vault. A forgotten vault password requires the separate vault recovery path.
Never share sign-in codes, authenticator setup information or recovery codes with support. An enabled button or successful local setup is not a guarantee that an external email or identity provider is currently available.