Sign-in Methods & Account Security
Manager supports password, Google, GitHub, WeChat, and Weibo sign-in. The sign-in page shows only providers that a platform administrator has enabled and fully configured.
First external sign-in
Provider email and display name are form suggestions only. You must confirm a username and email, accept the Terms and Privacy Policy, and verify the message sent by this service. A provider's email_verified assertion never becomes a local email credential.
If the external identity is unbound but you already have a local account, choose "link existing account" and verify its username/email and password. Accounts are never merged merely because two email strings match.
Pending-verification recovery
Before local email confirmation, the account remains pending. Signing in again with the same external identity returns to recovery, where you can resend the message or correct the email. Closing public registration does not block recovery for an account that was already created.
When a verification link is invalid or expired, the page shows an email input and a resend action. To prevent account enumeration, the page displays the same neutral success message whether or not that address exists or still needs verification; rely on the delivered email rather than the UI response.
Link, unlink, and set a password
Open Account Settings → Sign-in methods. Link and unlink require a fresh, action-bound check using the current password or an already-linked provider. An external-only account can verify through a linked provider and then set its first password. The last usable sign-in method cannot be removed.
Session impact
Link/unlink updates browser authorization: the current session remains after the successful action, while older browser sessions fail their next protected HTTP request. Confirming an email change invalidates all older browser sessions.
These actions do not actively disconnect an established signaling WebSocket or WebRTC session; remote-connection credentials have a separate lifecycle.
Provider data
Manager stores stable external account identifiers and may retain an email suggestion/display name for UI use. It does not persist provider access or refresh tokens. See the portal Privacy Policy for the full disclosure.