Account security & ownership transfer
Login credentials, MFA, passkeys, anti-phishing codes, inactivity lock, email changes, and self-service account deletion — the full security surface for an Aden user account.
What it is
Your Aden account has several layers of protection: a password (or OAuth via Google/Spotify), optional two-factor authentication (TOTP or passkey), an anti-phishing code embedded in every email Aden sends you, and an inactivity lock that can require a PIN after a period of idle time.
You can also change the email address on your account, and you can permanently delete your account when you no longer need it.
Using it
Change your password. Go to Account → Password. Enter your current password and then your new one twice. Password changes clear the MFA-verified session cookie so you'll be prompted to re-verify on the next protected action.
Set up two-factor authentication. Go to Account → MFA. Scan the QR code with an authenticator app (Google Authenticator, 1Password, etc.) and enter the six-digit code to confirm. From then on, signing in from a new session triggers a second prompt. You can also unenrol from the same page.
Add a passkey. Under Account → Login methods you can register a device passkey (Face ID, Touch ID, Windows Hello). Passkeys replace the password step when signing in on that device.
Set an anti-phishing code. Go to Account → Security and choose a
4–20-character personal code (e.g. sunshine42). Aden will include it in every
transactional email so you can instantly spot real messages from fakes.
Enable inactivity lock. Under Account → Security, turn on the inactivity lock and choose a timeout (1–480 minutes). After that idle period, reopening the app asks for your PIN (or biometrics if enabled). Team admins can also require inactivity lock for all members from Team settings → Security.
Change your email address. Go to Account → Security, enter a new address, and confirm both the old and new address via the links Aden sends. The change only takes effect after both confirmations.
Delete your account. Go to Account → Delete. The page checks whether you are the sole admin or sole member of any team — if so, you'll need to transfer those teams first. Once all blockers are cleared, confirm deletion. Your profile row is kept as a tombstone so collaborator credits on tracks and comments remain, but you can no longer sign in.