# Sign-in, passkeys and confirmation

You sign in to Rebasely with Google. Before a sensitive action, Rebasely asks you to confirm it's you, with a fresh Google sign-in or a passkey. Passkeys are optional.

## Signing in

Rebasely uses Google as its only way to sign in, so it never stores a password for you. A new account accepts the terms of service and the acceptable use policy first. Rebasely lets a limited number of new people in each day; past that, you join the waitlist and get an email when your place opens.

## Confirming it's you

Some actions need a recent confirmation, even when you are signed in:

- creating an access token or adding an SSH key;
- making a repository public, changing branch protection and other repository and organization settings;
- Actions secrets and deployment environments;
- creating and managing agents, and approving requests on [/approve](https://rebasely.com/approve);
- renaming, transferring or deleting a repository, an organization or your account, and starting a data export.

### 1. Rebasely asks

The action takes you to a Confirm it's you page, and back to where you were afterwards.

### 2. You confirm

Choose **Continue with Google** and sign in to the same Google account again, or use a passkey if you added one.

### 3. It lasts 2 hours

The confirmation covers this browser session for 2 hours after you last confirmed.

## Passkeys

A passkey confirms it's you with one touch (Touch ID, Windows Hello, a security key or your phone) instead of a Google sign-in. Add one on your [account page](https://rebasely.com/account); adding it needs a confirmation too. Passkeys are optional: everything works with Google alone, and you can dismiss the reminder to add one.

> **Tip:** Passkeys made on duragit.com before the rename keep working on rebasely.com in browsers that support related origins. In others, Rebasely sends you to confirm on the old host once and offers a new passkey for rebasely.com.

## Sessions

A session ends after 14 days without use, and after 30 days in any case. Your [account page](https://rebasely.com/account) lists your sessions; end one there, or **Sign out everywhere** to end all of them, including on other devices. SSH keys added before you sign out everywhere stop working too.

## New accounts

Until an account is 7 days old, or verified, it cannot make a repository public, write to live branches or turn live on, approve Actions runs or have the server write merge commits, and its pushes are checked more closely. It can still turn live off on a branch it can write to. This keeps throwaway accounts from abusing Rebasely; nothing changes for you after the first week.

## Your data

Download everything Rebasely stores about you from [Your data](https://rebasely.com/account/export), or delete your account there. The [privacy notice](https://rebasely.com/privacy) says what is kept and for how long. To report a security problem, email security@rebasely.com ([details](https://rebasely.com/security)).

---

Source: https://rebasely.com/docs/sign-in