Logging in and keeping your account safe

This guide is for everyone. You do not need to know anything technical. Each task has three parts: what you see, what to do, and what to do if it goes wrong.

Your account holds your API key, and your key pays for GPU time. Anyone who gets into your account can use that time. A good password and two-step login keep other people out.

• Password: a secret phrase only you know. We never save the password itself. We save a scrambled copy that cannot be turned back into the password.
• Email code: a six-digit number we send to your mailbox. It proves the mailbox is yours. You get one when you create an account, and when you forget your password. If your email already has a password, we do not send a code: we ask for the password.
• Two-step login (also called 2FA): a second proof when you log in. After your password you type a six-digit code from an app on your phone.
• Authenticator app: an app on your phone that shows a new six-digit code every 30 seconds, any authenticator app will do.
• Recovery code: one of ten spare codes. Each works one time. They are for the day you lose your phone.
• Session: the time your browser stays logged in. A laptop and a phone are two sessions.

What you see: the Log in page, with the buttons Continue with Google and Continue with GitHub (when available), then one box, Email, and the button Continue. Under it you read "New here? Enter your email and we'll send you a code to create your account."

What to do:

1. Type your Email and press Continue. If the email is new, we send a code. (If you open the page from a Join the waitlist link, the heading says Create your account and the steps are the same.)
2. Open your mailbox. Find the six-digit code. It is valid for 10 minutes.
3. Type the code into Code from your email. The page continues by itself after the sixth digit.
4. On Choose a password, type your New password and type it again in Repeat password. It needs at least 12 characters. A few random words work well. The page shows Too short, Fair, Good or Strong as you type.
5. Press Save password. You are logged in.

If it goes wrong:

• "That code is incorrect. Check the email and try again." Check the digits. After 5 wrong tries ask for a new code.
• "That code has expired. Request a new one." Press Resend code (it unlocks after 30 seconds) or Use a different email.
• "The two passwords do not match." Type the same password in both boxes.
• "Password must be at least 12 characters." Make it longer.
• "This step has expired." You waited too long. Press Log in again and start over.
• No email? Look in spam. Check the address you typed. Wait a minute, then press Resend code.
• "endlesstokens is not available in your country yet." New accounts are limited to some countries. You can join the waitlist.

What you see: the Log in page.

What to do:

1. Type your Email and press Continue. We do not send any email for this step. If your email has a password, the page shows your Email (you cannot edit it here; press Change to use another one) and a Password box.
2. Type your Password and press Log in.
3. If you turned on two-step login, the page Two-step check opens. Type the six-digit code from your authenticator app. It logs you in by itself after the sixth digit. If you type a recovery code instead, press Verify.

You can also press Continue with Google or Continue with GitHub (when available). The first time, we ask you to choose a password as well. If you use two-step login, the Two-step check still comes after Google or GitHub.

If it goes wrong:

• "Email or password is incorrect." The password is wrong, or the account cannot log in (for example it was closed). We do not say which, on purpose. If you are not sure of the password, use Forgot password?. For a closed or blocked account that shows the page that tells you to contact support. (An email with no password never gets this message: Continue sends you a code instead.)
• "Too many attempts. Please wait a few minutes and try again." Too many wrong passwords. Wait about 15 minutes. This pause lifts by itself.
• "This email already has a password. Log in with it, or use Forgot password." An older page asked for a code for an email that already has an account. Press Continue on the Log in page and type your password.
• "This account cannot log in. Contact <support email>." The account is blocked. Write to support. The address is on the Support page.
• "The server is busy. Please try again in a moment." Wait a few seconds and press Log in again.

What to do:

1. On the Log in page, press Forgot password?.
2. Type your Email and press Send code. (If you already typed your Email on the Log in page, it is filled in.)
3. Type the six-digit code from your mailbox and press Continue.
4. If you use two-step login, the Two-step check comes next. Type a code from your app, or a recovery code, and press Verify. We ask for this so that someone who only has your mailbox cannot take over your account.
5. On Choose a password, type a New password twice and press Save password.

You are logged in, and every other device is logged out.

If it goes wrong: if you also lost your phone and your recovery codes, go to section 9.

What to do:

1. Open Account in the menu. Find the Security card.
2. Next to Password press Change password.
3. In the window, type Current password, then New password and Repeat new password.
4. Press Change password.

You see "Password changed. Other devices were logged out." You stay logged in on this device.

If it goes wrong: "Email or password is incorrect." means the current password is wrong. Use Forgot password? if you do not remember it.

Before you start, install an authenticator app on your phone.

What to do:

1. Open Account. In the Security card, find Authenticator app. It shows Off. Press Turn on.
2. If a window titled Confirm your password opens, type your password and press Confirm. It stays valid for 15 minutes, so you are asked only now and then. Then the window Set up your authenticator app opens.
3. In your app, add a new account and scan the QR code. If you cannot scan, type the Secret shown below the QR code into the app by hand.
4. Type the six-digit code your app shows into Code from your app.
5. Press Confirm and turn on.
6. The window Save your recovery codes shows ten codes. They are shown only now. Press Copy codes or Download codes, or write them down, and keep them somewhere safe such as a password manager. Never keep them only on the phone that has the authenticator app.
7. Tick I have saved them, then press Done.

The Security card now shows Authenticator app On and "10 recovery codes left". Other devices are logged out.

If it goes wrong:

• "That code is incorrect. Check your app and try again." Wait for the next code and type it. Check that your phone's clock is set to automatic.
• "This set-up has expired. Start again." Close the window and press Turn on again.

See section 2. After your password, type the six-digit code from the app. Each code works once, so if a code is rejected, wait for the next one.

What to do:

1. On the Two-step check page, type a recovery code (it looks like xxxx-xxxx-xxxx) into Code.
2. Press Verify.

That code is now used and cannot be used again. After you log in, open Account and press New recovery codes, or press Replace authenticator if your phone is gone. The Security card tells you how many recovery codes are left.

If it goes wrong: "That code is incorrect." The code may have been used already, or has a typing mistake. Try another recovery code.

New recovery codes (when few are left, or you lost the list):

1. Account, Security card, press New recovery codes.
2. In Get new recovery codes, type a code from your authenticator app (a recovery code is not accepted here) and press Get new codes.
3. Save the ten new codes as in section 5 step 6 and 7. The old codes stop working.

Replace your authenticator app (new phone):

1. Account, Security card, press Replace authenticator.
2. In Replace your authenticator app, type a code from your current app (or a recovery code) and press Continue. Your current app keeps working until you finish.
3. In Set up your new authenticator app, scan the new QR code or type the Secret, type the code the new app shows into Code from your app, and press Confirm and replace.
4. Save your new recovery codes. The old app and the old recovery codes stop working. Other devices are logged out.

Turn two-step login off:

1. Account, Security card, press Turn off.
2. In Turn off two-step login, type a code from your app or a recovery code and press Turn off.

This also deletes your recovery codes. You can turn it on again later.

If it goes wrong: "Too many incorrect codes. Please wait a few minutes and try again." Wait, then use the next code.

You cannot log in without the second step. Write to support from the address of your account. The address is on the Support page. We will check that it is really you, in a way that cannot be done by email alone, for example a call. Then we turn off two-step login on your account. We email you when it is done.

After that, log in with your email and password only, open Account, and press Turn on to set up two-step login again. Your password is not changed. If you forgot your password too, ask us to reset two-step login first, then use Forgot password?.

Press Log out at the foot of the menu to leave this device.

To leave every other browser and device, open Account, find Other devices in the Security card, and press Log out other devices. You see "Other devices are logged out." This device stays logged in. You do not need to type your password. Use it when you used a shared computer or think someone else is logged in. If you think someone knows your password, also change it (section 4).

Other devices are also logged out for you when you change your password, turn two-step login on or off, or replace your authenticator app. Support also logs you out everywhere when it resets your two-step login.

Our emails show dates and times, for example when your pass ends. They use your time zone and show its short name, such as 19 Oct 2026, 12:00 PM IST.

What you see: on Account, the card Time zone with a list. It starts as Not set. When you log in or join the waitlist, your browser tells us its time zone, and we use that until you choose one. Under the list you may read "Suggested from your billing address". It is India Standard Time for an Indian address, and the main zone of the state for a US address.

What to do:

1. Open Account. In the Time zone card, pick your zone from the list. Each one shows its offset from UTC.
2. Or press Use this under the suggestion.
3. Press Save. You see "Saved".

If it goes wrong:

• "Choose a time zone from the list." Pick one entry from the list.
• Your zone is not in the list? Pick the nearest city in the same zone.
• If you never choose a zone and we cannot read the one from your browser, emails show times in UTC.

We keep a scrambled copy of your password (never the password itself). If you use two-step login we keep the secret behind your codes, locked with an encryption key, and a scrambled copy of each recovery code. Read the Privacy Policy for the full list and how long we keep it.

If you delete your account, we delete your password, your authenticator secret and your recovery codes, and every device is logged out.