Your account

Manage your profile, password, passkeys, and API tokens from the profile page. Click your avatar in the sidebar (or the top-right on mobile) → your name to land on /users/<your-id>.

The page has horizontal tabs along the top:

Tab	Who sees it	What it holds
Info	you (own profile only)	Personal info + membership info
My work	you	Speaker profile + contribution goal
Security & access	you	Passkeys, API tokens, Hugging Face token
Preferences	you	Interface language, email volume and email digest (keyboard shortcuts open from the floating ⌨ button on any page; reputation sharing lives on Analytics → Reputation)
My templates	you, if you can create projects (org owner/admin/manager or platform staff)	Your saved labeling-config templates
Cloud sync	you, desktop app only	The desktop's local mirror + cloud sync preferences; Link account card for device-only accounts
My consents	you	Consent templates you've accepted, with revoke
Analytics	you + org admins	Annotation activity metrics — Overview, Quality, Contributions, plus Reputation (consent-gated) and Earnings (you only: contributions statement + receipts)

There is no separate Settings tab any more — everything editable opens in a focused modal from its tab. Old /users/<id>/settings links redirect to Info.

Info — personal info + membership

Read-only facts render as cards; anything editable opens a modal from a button:

• Personal info — avatar, name, email, phone. Clicking your avatar opens the Edit-profile modal (which contains the avatar picker), as do the Edit profile and Change password buttons in the card's title row.
• Membership — the active organisation by name, your role there, when you joined, annotations submitted, projects contributed to and your user ID. See Members and Roles.

My work

• Speaker profile (optional) — voice metadata for speech projects; only attached to recordings if you tick the sharing consent.
• Contribution goal — personal daily goal, streak, and opt-in project leaderboards.

Your validated work per project (with amounts when a project shares its rate card) lives on Analytics → Earnings.

Speaker profile

Every field is optional: age band (under 20 … 70+), gender, and the language varieties you speak (comma-separated, strongest first). Nothing is attached to your recordings unless you tick the sharing consent — recorded with a version and timestamp, revocable by unticking and saving. Projects with audio QC enabled ask you to complete this step before you can record; completing may mean leaving every field blank and declining the consent — the deliberate choice is what's required, never the disclosure.

Contribution goal

Set a daily goal (0 = off, up to 10 000). Annotations you submit and validation votes you cast both count. With a goal set, the card shows today's progress bar and your day streak — consecutive active days, anchored so that today not being over doesn't break yesterday's streak. Tick Show me on project leaderboards to opt in, optionally with a leaderboard name (blank = first name); appearing anywhere public is never a side effect. Save applies all three at once. See Goals, streaks & language progress.

Security & access

• Passkeys — a Manage passkeys button opens the passkeys modal. See Passkeys below. Hidden when neither WebAuthn nor the mobile apps' native passkey bridge is available.
• API tokens — a Manage tokens button that opens the API tokens page. See API access tokens below. Hidden when your platform has disabled personal access tokens.
• Hugging Face — your HF access token for project-level Hub imports/pushes. Stored encrypted, never shown back in full.

Edit profile (modal)

• First name + Last name — text inputs.
• Email — read-only with a Change email button. Clicking it expands a sub-form for the new address; the current email stays active until you click the verify link the platform emails to the new address. A pending change shows a "check that inbox" hint. Email change runs against the cloud — it's unavailable offline.
• Phone — text input.
• Avatar — two tabs: Gallery (pick from the built-in avatar sets) or Upload (JPG, PNG, or GIF, square works best, max 1 MB).

Change password (modal)

• Current password (required for verification)
• New password (min 8 characters, must differ from current)
• Confirm new password — must match

After a successful change, the form clears + a toast confirms. Your active session stays signed in.

Passkeys

Sign in with your fingerprint, face, or a hardware security key instead of your password. Passkeys are domain-bound — the authenticator ties each credential to the exact site it was created on, so they can't be phished or replayed against another deployment.

Add a passkey

1. On your profile's Security & access tab, click Manage passkeys, then Add a passkey.
2. Confirm your account password — same rule as API tokens: a live browser session alone must not add a durable credential. (SSO accounts without a password skip this step.)
3. Click Create passkey and complete your device's prompt (Face ID, fingerprint, PIN, or security key).

The passkey is named after your device automatically and appears in the card's list with its created date and last-used date.

A new passkey must check that it is you: your device asks for your fingerprint, your face or its PIN when you add the passkey and each time you sign in with it. A security key that has no PIN set cannot be added; set a PIN on it first. Passkeys added before this was required still work.

An account holds at most 10 passkeys: one for each device you sign in from, plus a spare, is plenty. To add an eleventh, remove one you no longer use.

Sign in with a passkey

Use the passkey option on the sign-in screen — no email needed. Your device lists the passkeys saved for this site; pick your account and confirm with fingerprint or face. Works on the web and inside the mobile apps (the apps run the ceremony natively through Face ID / Android's Credential Manager).

On the sign-in page, a Sign in with a passkey button appears below the email form (only on browsers with WebAuthn). It works at either step:

• Without typing your email — your authenticator offers the accounts it has stored for this site (discoverable credentials).
• After typing your email — the request is scoped to that account's passkeys.

See Sign in for where the button lives in the sign-in flow.

Manage passkeys

Each entry is named after the device and where it syncs (for example "iPhone (iCloud Keychain)" or "SM-S938B (Google Password Manager)") and can be renamed. A passkey syncs to your other devices in the same ecosystem automatically — one per ecosystem (Apple / Google) is enough; you don't need one per device.

Each passkey in the list has Rename and Remove buttons — removal is immediate. You can register multiple passkeys (one per device); registering the same authenticator twice is blocked.

Adding, removing, and signing in with a passkey are all recorded in the platform audit log.

Limits

• Domain-bound: a passkey created on the cloud site works only there. The desktop app registers its own local passkeys the same way; they don't transfer between the two.
• Mobile app: supported — the iOS and Android apps run the ceremony through a native passkey plugin (Face ID / Android Credential Manager) bound to the cloud domain.
• A passkey signs you in but doesn't replace your password — password-gated actions (creating tokens, adding more passkeys) still ask for it.

API access tokens

Personal access tokens authenticate scripts, the SDK and other tools as you. They have a page of their own: your profile's API tokens tab, also reached from the user menu (API tokens) and from Security & access → Manage tokens. Make a token sits in the card's title row; each token is a row with its name, a hint of its tail, what it may do, where it reaches, when it expires and when it was last used, with Revoke beside it.

• Make a token asks for:
  1. A name: what will use it ("Export job", "My laptop"). Two to forty characters of letters, digits, spaces and - _ . : / ( ), and it should mean something: a keyboard mash ("gggg", "qwerty", a run of one letter) is refused. No two of your live tokens may share a name (case does not count), so the list always tells them apart.
  2. What it may do: Full access (everything you can do), Read only (nothing is changed: any write is refused), or Chosen areas: for each of Projects, Tasks and data, Annotations and predictions, Exports and releases, Cloud storages and imports and Model backends and training, none, read or write. A token with chosen areas can still read your own identity and the project settings it reaches, but changes only what its areas allow; a script that only annotates gets Annotations: write and Tasks: read and nothing else.
  3. Where it reaches: every project you can reach, or only the projects chosen from the list. A token confined to projects can open those projects, their tasks, annotations, predictions, storages, imports, exports and model backends, and your own identity; it cannot list projects, read the organisation, or touch other people.
  4. Expires after: 7 days, 30 days, 90 days (the default), a year, or no expiry. An organisation's own cap on token life (Organization, Settings, Access) shortens any of these.
  5. Your account password (accounts without a password skip this).
• The token is shown once. The server keeps it without its signature, so it can never be displayed again.
• A week before a token runs out you are told once, in the app and by email, with a link to this page: make a new one and move whatever uses the old one across.
• You can have as many tokens as you need, one per use, so that revoking one does not stop the others.
• The list shows each token's name, its start and the tail you copied, what it may do and where, when it expires, when it was last used and from which address, and how many times.
• Revoke is two-click: the first click arms the button ("Really revoke?"), the second revokes. It takes effect at once and cannot be undone; make a new token instead.
• Making and revoking a token are in your organisation's audit log.
• Device sessions (desktop cloud link, mobile sign-in, passkey sign-in) do not appear in this list — it holds only tokens you made.

Use tokens as Authorization: Bearer <token> in API calls — see API → Authentication.

Preferences tab

How the platform behaves for you:

• Language — locale switcher for the UI. The choice persists to your account and to the device.
• Email digest — a periodic summary email of activity that concerns you: review outcomes on your annotations, progress toward your contribution goal, newly required consents, and new public projects you can join via Discover. Pick Off (default — you get no digest emails), Daily, or Weekly. A digest is only sent when there's actually something to report, and per-event notification emails are unaffected by this setting. Delivery depends on your operator scheduling the send_notification_digests job.
• Email volume — how much of your notifications also email you: Everything, Essential (skips chatty emails), or Critical only (security, consent receipts, payouts, account changes). The in-app bell always gets everything.

Cloud sync tab (desktop-only)

Visible only when you're on the desktop app, not on the cloud web UI. Manages the desktop's local mirror + cloud sync preferences. See Cloud sync profile.

Link account

Shown only while your desktop account is device-only (created offline, no cloud identity); hidden everywhere else. The card states what linking sends to the cloud — your email, name, password (to create the cloud account) and, going forward, your annotation work on shared projects; device-only projects are not uploaded. Tick the consent box (it starts unticked), re-enter your password, and Link to cloud; the button stays disabled until both are present and the server refuses to contact the cloud before consent. On success the cloud records a user.account_linked audit event and emails the account address a receipt — when, from which device, and what was consented to, with an "if this wasn't you, change your password" pointer — and the app reloads into the linked world while your cloud projects pull in. Needs a connection; offline it fails with a message and nothing changes. Full flow: Cloud sync profile.

My consents tab

Lists every consent template you've accepted, with the version, date, and an option to Revoke. Revoking an actively-required consent removes your access to projects requiring it; past annotations stay in the dataset, flagged. See Consent library.

Analytics tab

Your annotation activity metrics. Also visible to platform admins and your org's owners/admins — it's the only tab they see on your profile. Sub-tabs: Overview, Quality, Contributions (per-project breakdown + recent submissions), and two that are gated:

Reputation

Your cross-organization track record, computed live from validated work only — validated units (by kind: annotations accepted, votes cast, prompts accepted, clips validated), acceptance rate, evaluation pass rate, projects, organizations, active since / last active, and languages. Rates are only quoted above a volume floor; below it you see Insufficient data (n/floor) rather than a percentage. You always see it, with a status pill in the title row saying whether it's currently shared; other viewers only see the sub-tab once you've enabled Share my reputation profile in the Share reputation dialog on Analytics → Reputation (org names appear only if you also enabled Show organization names). Desktop shows a link-out to the cloud app instead. See Reputation profiles.

Earnings (you only)

• My contributions — your validated units per project, with the owner-declared amount when the project shares its rate card. Filter All / Paid / Pending (paid = covered by a payout run the org marked paid; pending includes entries in draft runs), Paid on date, a total row per currency, 10 / 25 / 50 rows per page, and a Download CSV of the statement. Headline chips show what has been paid out to you and what is validated but unpaid. Amounts are computed from rates the project owner declared; payment itself is arranged by the project — the statement is your record.
• Your receipts — one row per payout run that paid you: paid-on date, organization, period, amount. Receipt PDF (rendered with the org's default receipt template, amounts frozen as they were paid) per run; the server only ever lists runs whose frozen breakdown includes you. Hidden while you have no paid runs. On the desktop the card links out to the cloud app — receipts carry a verification code only the cloud can generate. See Contributions & payment.

What's next

• Security model → — what AfriAnnotate does behind the scenes to keep your account safe
• API → Authentication → — using your token in scripts
• Roles + permissions → — what your org role lets you do