Profile & security

Your profile is where you manage your account details, interface language, the extra profile fields your organisation asks for, and your personal API tokens.

Profile details

Your profile shows your name, email and role — read-only: changing them is done by an administrator on the user management page. Your display name is worth keeping recognisable — it's what colleagues see in assignments, comments and mentions.

Interface language

Choose your interface language on the profile page. The choice is yours alone: it doesn't affect anyone else, and your administrator's default only applies until you pick one.

Once you have picked a language yourself, it also travels with your notifications — emails and messenger notifications are written in your language, not the language of whoever triggered them.

Appearance (theme)

The theme switcher sits in the top bar, offering dark, dark compact, light and high-contrast, or following your operating system. Dark compact tightens spacing to fit more on screen. Your choice is remembered on your device and affects nobody else.

Additional profile fields

If your administrator has defined additional profile fields — phone, messenger handle, job title and the like — you fill them in on your profile. Required fields are marked, and depending on how strictly your organisation has configured this you'll either see a reminder banner or be asked to complete them before continuing.

Ordinary colleagues can't see your values: they are visible to you, and to admins and managers. Where they are used is up to you — for example, marking a contact as usable for notification channels.

Notification preferences

Notification settings live on the Notifications page rather than in the profile: which events reach you, through which channel, due-date reminders, and which contact fields from your profile an outgoing gateway may use. See Search & notifications.

Your password

Change your password using Forgot password on the sign-in screen — you'll get a reset link by email. Administrators can also set a password for you or send you a reset link from the user administration page.

If you can't sign in

An administrator can send you a reset link, set a new password, or end all your sessions if you think your account has been used by someone else. Ask them rather than working around it.

Signing in through your organisation's provider

If your administrator has enabled single sign-on, the sign-in screen shows provider buttons — "Sign in with …". Your credentials are then checked by your corporate identity provider rather than by TaskFlow, and your account here is created on first sign-in.

What that means in practice:

• such an account has no TaskFlow password — "Forgot password" would set one locally, but the provider button remains the easier route;
• your name and email come from the provider, and the role your account is created with may be derived from your group there;
• an administrator can disable password sign-in entirely, leaving only the provider buttons.

If a provider button returns you to the sign-in page with an error, it's a configuration matter on your organisation's side — ask your administrator, see Single sign-on.

Personal API tokens

API tokens let external tools act on your behalf — connect an AI assistant over MCP, or call the API from a script. Manage them on your profile page.

Creating one asks for:

• A name — so you can tell later what a token is for.
• A scope — one of three:
  • full access — everything you can do: MCP and the GraphQL API;
  • read-only (MCP) — read-only MCP tools; the API is closed to it;
  • configurator (MCP) — administrative MCP tools (structure setup: features, permissions, workflows). Operational tools and the API are closed to it, and only an admin can issue one.
• An expiry — 30 days, 90 days, 1 year, or never.

You can hold at most 25 active tokens at once — to issue another beyond that, revoke the ones you no longer need.

Once created, the token is shown only once — copy it then and store it somewhere safe. The list afterwards shows each token's name, permissions, creation date, expiry, last use and status (active, revoked or expired). Any active token can be revoked — revocation takes effect immediately; revoked and expired tokens stay in the list as history.

A token inherits your permissions — it can do exactly what you can, and no more.

Treat tokens like passwords

Anyone holding a full-access token can act as you. Store tokens in a password manager or secret store, prefer read-only when a tool only needs to read, set an expiry rather than "never" when you can, and revoke tokens you've stopped using. For automation that shouldn't be tied to a person, ask an administrator to set up a dedicated bot account.

Using tokens with AI clients and the API is covered in Integrations → AI & API access.

Where to go next

• AI & API access — connect assistants and scripts.
• Search & notifications — manage what reaches you.