Skip to main content

Account Security

Open Settings in the dashboard, choose You at the top left, then choose an area under Security: Overview (/dashboard/settings/security), Sign-in & 2FA (/dashboard/settings/security/login), Sessions (/dashboard/settings/security/sessions), or Activity (/dashboard/settings/security/activity). These areas belong to your Lumio profile, even when no channel is selected. The links open the settings window over the dashboard home; while you work in the dashboard, the window stays over your current page and its address ends in #settings/security/….

Overview shows a ring with how many of four checks are done and one tile per check: sign-in methods, two-factor authentication, active sessions, and failed sign-ins of the last 30 days. The sessions tile names the device and place of the session unused for the longest time when one has been idle for more than five days; the failed-sign-in tile names the date, place and device of the latest attempt. Tiles that still need attention carry an arrow to their tab. In Streamer Mode the place in both sentences appears as •••••••• with an Eye; the Eye reveals only the place without opening the tile's area, and the rest of the sentence stays.

Sign-in methods​

You can sign in with Twitch, Kick, Google, Discord, or a verified email address and password. Google is the sign-in method; a YouTube channel connection is a separate connection. For Google, the ID shown after # is your Google account ID, not a YouTube channel ID. The Sign-in & 2FA area's Login connections card groups platform connections by provider and ends with the Email & password row and shows the channels assigned to each connection. A connection that has to be reconnected gets a red frame and a Reconnect button. Reconnecting opens the sign-in page for exactly that connection: it shows the account in one row - provider logo, name · platform ID and its state (disconnected, rights missing or connected) - and asks you to sign in to the provider as that account. A different provider account is turned down without changing anything; the page then names the account you were signed in with and the one that is needed, and suggests signing out at the provider or using a private window. You can add a channel or confirm replacement of an existing assignment. Each channel chip has an × that removes the assignment. A sign-in does not decide a channel's name or picture; that is set in the channel settings. With account:edit in the active channel, the top of the card says so and links there.

To add a platform sign-in, choose Connect in its group. The dialog explains the provider hand-off and lets you select up to 25 channels to assign. Confirm Is it really you? first: with 2FA enabled, confirm with a passkey, authenticator app code or recovery code; otherwise confirm with an existing sign-in method. The dialog lists them under Confirm with, each with when it was last used or connected; the one you last signed in with is pre-selected, and one that must be reconnected cannot be chosen. The browser then goes to the provider and returns to the dashboard with a success or error notice. Reconnecting an existing link to the same provider account does not require this extra confirmation. Removing a login method requires it and is refused if it would leave you with no sign-in method.

Email and password​

To set up email sign-in on an existing profile, choose Set up in the Email & password row, the last row of the Login connections card. The row shows the state: not set up, a pending link (with when it was sent), or active (the address, when it was confirmed, and when the password was last changed). Enter the address, pass the Is it really you? check, then open the confirmation link from your inbox. The check slides into the same dialog like the other steps, which stays on the Address step while it asks; it is skipped if you confirmed in the last 10 minutes. The link is valid for 24 hours, and until you finish nothing changes about how you sign in. The waiting dialog advances even if you open the link on another device. The link's page asks for a deliberate Confirm click; merely loading the page does not confirm it. Return to the dialog, choose a password (the eye button shows what you typed; a check mark appears once both entries match), and review the finished state. From then on the address is also your Lumio email: notifications and security emails go there. The progress bar at the top of the dialog shows where you are: Address, Confirm, Password. An unconfirmed request does not reserve the address. If the address already belongs to another Lumio profile, it gets a notice instead of a link, saying that you can sign in with it or remove it there first under Security › Sign-in; nothing changes. Once the password is set, Lumio sends a security email to your previous profile address and to the new one. It names the new address, the date and time (in your timezone), the browser and operating system and, when it can be determined, the country — never the IP address. If that wasn't you, open Security and remove the method. In Streamer Mode every address in this row and in the setup dialog, including the address field, appears as •••••••• with an Eye to reveal it.

The same section lets you change the sign-in address, resend or cancel a pending link, change the password, or remove email sign-in. The old address remains active until its replacement is confirmed. A password reset starts from Forgot password? on the ID-app sign-in page; the response does not disclose whether an address has a Lumio account. Completing the reset ends existing sessions, while 2FA stays enabled. Email confirmation by itself never signs you in.

After a wrong password, the entered password stays in the field, marked red, so you can correct it. From the second wrong password on, Cloudflare Turnstile checks in the background that a person is signing in; if Cloudflare is unsure, a checkbox appears across the card, the red notice asks you to confirm you are human, and Sign in stays locked until you tick it. Registration, Forgot password? and resending a link run the same check, and lock their button the same way while the checkbox waits. After five wrong passwords for an address, password sign-in pauses for 15 minutes. The sign-in page then shows Short break with the remaining minutes, Reset password, and the platform buttons, which keep working. If Lumio cannot be reached, the page says so, keeps its buttons visible but locked, and tries again on its own every few seconds.

Your email sign-in also sets your profile email, the address Lumio sends mail to, invoices and notices included (the setup dialog says so too): while you have an email sign-in, the profile email is always its confirmed address and follows when you change it. This section is the only place where you set an address; Settings → Profile shows the profile email and its source and links here. When you remove the email sign-in, the profile email goes back to the address a platform sign-in gave you before, or is empty. A platform's unverified email claim is not proof that it owns your email sign-in, and Lumio does not automatically link profiles by matching email text.

Two-factor authentication and recovery​

Open Security → Sign-in to manage your profile's authenticator apps and passkeys. You can keep up to five authenticator apps and ten passkeys together. Your first method turns 2FA on; turning 2FA off removes every method. The Security overview shows the number of each. Each method has its own name (up to 40 characters), added date and last-used date; you can rename or remove it. Choose names without personal details. Only you see these names, not administrators, audit entries or security notices.

Choose Set up or Add a method, then choose Passkey or Authenticator app. Both require a recent Is it really you? confirmation. To add an app, scan its QR code or enter the shown key, then enter its six-digit code. Adding another app does not replace an existing one. For your first method, save the ten recovery codes and finish setup; adding further methods does not issue another set. A recovery code works once. Generate new codes replaces all unused codes immediately. Keep a copy somewhere private.

A passkey lives on a device, security key or password manager. It combines possession with unlocking that device or password manager; it does not demand a fingerprint at every sign-in. Choose Add passkey, complete your browser or password manager prompt, save the ten recovery codes if this is your first method, and name the passkey. The registration challenge lasts five minutes. If it expires, restart setup and discard the codes shown in that attempt. The list shows your chosen name and, when the browser supplies a known AAGUID, the provider or YubiKey model. Where Lumio has that provider's logo, it appears next to the name; otherwise the tile shows a generic passkey symbol. Some browsers suppress the AAGUID when Lumio requests no attestation; the entry then says Passkey with the generic symbol and can be renamed. A synced passkey and a device-only passkey are labelled accordingly. When at least one logo appears, the list shows this notice: Provider logos are trademarks of their respective owners. Lumio is not affiliated with these providers. Add a second passkey on a different device or password manager so losing one does not leave you relying only on recovery codes.

Save a passkey in Bitwarden or 1Password​

To save one in Bitwarden, open its browser extension and turn on Settings → Notifications → Ask to save and use passkeys. Choose Add passkey in Lumio and accept Bitwarden's save prompt. To use your device or a hardware key instead, choose that option in Bitwarden's prompt. Turn the same extension setting off if you do not want Bitwarden to offer to save or use passkeys; this also stops prompts for passkeys already in your vault. You can also exclude an individual domain. See Bitwarden's passkey guide. For 1Password, unlock the vault and choose it when the browser offers a place to save the passkey. Your browser and installed extensions determine which providers appear.

Passkey prompts need a supported system browser. OBS and Streamlabs browser docks are unsupported; open Lumio in a regular browser to create or use a passkey. Embedded in-app browsers such as Twitch or Discord on iOS and Android may not support them either. On Firefox for Linux, use a USB security key or passkey extension; phone QR hand-off is unavailable. Bitwarden's Firefox extension may not offer inline autofill; the Sign in with passkey button can still open it. If a passkey prompt fails, use an authenticator app or recovery code and try a supported browser.

When 2FA is on, every new email or platform sign-in asks for an app code, passkey or recovery code before a session begins. Signing in with a passkey already completes that second step. A trusted device can skip the second step for 30 days; revoke one or all trusted devices in the same section. Sensitive actions, including removing a method, turning 2FA off and generating new recovery codes, accept a passkey, an app code or a recovery code. Removing an individual method asks for confirmation; use Turn 2FA off to remove the last one. If you remove a passkey in Lumio, delete its entry from your device or password manager yourself; supported browsers may hide the unusable entry automatically. Removing the last method also clears recovery codes and trusted devices. If you lose all methods and recovery codes, contact support for a manual identity check and 2FA reset; the operator must record a reason.

If your account has admin access to Lumio and no 2FA method yet, the dashboard asks you to set one up: a dialog explains that admin access stays locked until you add a passkey or an authenticator app. Set up two-factor opens Security → Sign-in and starts the choice of method. Later hides the dialog until you close the browser; everything except admin access keeps working. The admin app sends you to the same dialog. Once your first method is added, the dialog no longer appears.

Lumio receives a passkey's public credential and signature, never biometric data or its private key. Registration sends your display name, never your email address, to the provider. Lumio requests attestation: none and does not use FIDO Metadata Service (MDS) to identify the device; provider names come from a local AAGUID list, with no runtime lookup.

Sessions and activity​

Sessions (Active sessions) shows device, sign-in method, whether 2FA was verified, approximate location, IP address, and last activity. Location can be absent when it cannot be resolved. The current session is marked This device and says in its row that it cannot be signed out here. The top of the table counts the sessions and the ones unused for more than five days (marked yellow), and holds Export, Sign out unused (N) while at least one session is unused, and Sign out all others; a note below the table says how many other devices Sign out all others signs out. Sign out unused asks for confirmation and then signs out exactly the sessions marked yellow, never this device. Sign out another session with its Sign out button, or tick several and use Sign out selected in the band that appears above the table. You can export all sessions or the selection as CSV or JSON. Streamer Mode covers the IP address and the location on screen; the export contains them in full.

Popout tokens are separate credentials and do not appear as sessions here. Revoking a browser session does not by itself revoke a popout token; manage those under Tokens.

Activity (My activity) records your personal security events. Where the event carries it, the text names the context, for example Sign-in via Twitch, Identity confirmed via authenticator app or Login connection Kick added. Platforms appear under their brand name; a confirmation with an app code, a recovery code or the password is named as such. Filter by event or date (an empty end date means "until today"), expand a row for metadata and device details, and export the current filter or a selection as CSV or JSON. The export dialog shows the file name and its approximate size before the download; Details (JSON) starts unticked because the raw metadata is large. In Streamer Mode the IP address, location and user agent are masked per row, as in the Audit Log. The account-wide audit log has its own permission and page; see Audit Log.