User Settings
The profile page is accessible to every logged-in user at /profile. It covers personal data, two-factor authentication, passkeys, and account deletion.
Personal Data
Users can update the following fields:
| Field | Required | Description |
|---|---|---|
| Username | Yes | Unique login name |
| Yes | Unique email address | |
| First name | No | Optional |
| Last name | No | Optional |
Changes are saved by clicking Save. Username and email must be unique across all users — a conflict with an existing account will be rejected.
Two-Factor Authentication (MFA)
DockWallet supports TOTP-based two-factor authentication via any standard authenticator app (e.g. Google Authenticator, Aegis, or 1Password).
Enabling MFA
- Click Set up MFA on the profile page.
- A QR code and a text secret are displayed. Scan the QR code with your authenticator app, or copy the secret manually.
- If SMTP is configured, you can also have the current code sent to your email address for verification.
- Enter the 6-digit code from your app and click Activate.
MFA is only enabled after a valid code has been confirmed.
Disabling MFA
Click Disable MFA and confirm with a current 6-digit code from your authenticator app. The TOTP secret is deleted immediately.
Login with MFA enabled
On the login page, username and password are entered as usual. If MFA is enabled, a second prompt for the 6-digit code appears before access is granted.
Passkeys
Passkeys enable passwordless login using biometric methods (Face ID, fingerprint) or hardware security keys. They are managed per device.
Adding a Passkey
Enter an optional device name (e.g. "MacBook Pro") and click Add. The browser will prompt you to complete the registration using your device's authentication method.
Removing a Passkey
Click Remove next to a passkey to delete it. If all passkeys are removed, login via passkey is no longer possible and the regular password login must be used instead.
Admins can also remove all passkeys for a user from the admin panel, for example if a device has been lost.
Deleting Your Account
At the bottom of the profile page, regular users see a Danger Zone section with the option to delete their account.
Clicking Delete account sends a confirmation email to the registered address. The account is only deleted after clicking the link in that email. All passes are permanently deleted along with the account.
Admin accounts cannot be deleted by the user themselves. Contact another admin to have an admin account removed.