Manage identity and signed-in sessions

Wallet and account · How-to · App authentication controls; these do not recover or rotate wallet keys.

Use identity settings and session revocation while respecting the separate wallet-authority boundary.

Reviewed: 2026-10-18

Before you start

  • An authenticated account with access to Account and Settings.

Manage email, password and two-factor

Settings shows the current email and two-factor state. Manage email, password and two-factor opens the Clerk profile dialog, where available methods and required verification are managed by that provider.

Keep identity changes separate from financial recovery. Changing email, password or MFA does not replace a Solana private key or restore the original Turnkey browser owner authority. Never enter a wallet key into an identity verification prompt.

  1. Open /account/settings and inspect Identity and sign-in.
  2. Select Manage email, password and two-factor.
  3. Follow the provider’s offered controls and verification, then check the resulting state in Settings. If an action fails, read that error rather than assuming the change completed.

Inspect and revoke sessions

Account shows current and other returned signed-in sessions with creation, last-seen and expiry times. Revoke removes the selected app session; revoking the current session signs you out. Revoke all other sessions keeps the current one while requesting revocation of the others.

A failed session read or “No active sessions were returned” is not proof that every possible access path has been eliminated. Read action errors and refresh the list after changes. An unavailable security token requires refreshing the authenticated page, not copying a token from someone else.

  1. Open Account and inspect the active sessions list.
  2. Revoke an unfamiliar individual session, or use Revoke all other sessions when appropriate.
  3. Wait for the updated list. If revoking the current session, expect sign-out and use your normal sign-in method if needed.
  4. Review security notice history for associated activity and independently inspect any affected wallet transaction.

Revocation is not wallet-key revocation

Session revocation changes app authentication, not possession of an already-exported key or authority in a separately controlled wallet. Native wallets remain server-managed; importing a native key elsewhere does not remove platform signing access.

If a key may be exposed, do not assume a password change makes it private again. Preserve access and transaction evidence, inspect current wallet capabilities and use only a verified destination for any separately authorized transfer. Do not resend unresolved withdrawals.