Security and account

Ways to sign in

The sign-in page asks for your email first, then offers the methods available to that address. Settings → Account → Ways to sign in shows which ones are linked and lets you connect or unlink them; you cannot remove the last one.

Passkeys

1. Step 101

   Add a passkey

   Settings → Account → Passkeys → Add a passkey. Give it a name you will recognize (for example "MacBook Touch ID"), then confirm with your fingerprint, face or screen lock.
2. Step 202

   Use it

   On the sign-in page choose Sign in with a passkey. A passkey covers the second factor as well, so the checklist shows two-factor as already covered.
3. Step 303

   Rename or remove

   Each passkey shows whether it is synced across your devices or saved on this device only. Removing the last passkey is refused unless another sign-in method exists.

Akili passkeys need a screen lock or biometric check, so a security key without a PIN cannot be used. Without a fingerprint or face unlock, the browser offers your phone or a security key with a PIN instead.

Two-factor authentication

• Authenticator app (TOTP). Settings → Account → Two-factor authentication → Turn on: scan the QR code, enter a six-digit code, then save the backup codes shown once.
• SMS. Verify a phone number and Akili texts a one-time code at sign-in. SMS as a second factor is included on Max, Business and Enterprise plans.
• Backup codes. Use one when you have no phone; the checklist warns when they are all used. Turning two-factor off removes every method at once.
• Organization requirement. A workspace policy can require multi-factor authentication; the section then reads “Managed by your organization”. SSO accounts show “Managed by your identity provider”.

Trusted devices and step-up checks

At the two-factor prompt, Trust this device for 30 days skips the prompt on that browser until the date shown. Settings → Account → Trusted devices lists each one with when it was last used and until when it is trusted; Remove makes that device ask for the second factor again.

Sensitive changes ask you to confirm it is you even inside a session: adding a password, turning two-factor on or off. A sheet asks for your password, passkey or a fresh code before the change goes through.

Sessions and sign out everywhere

Where you are signed in lists every device with an active session: the network it came from (not a city), the account and when it was last used, with a flag for a session that is alone on its network or dormant. Sign out ends one session.

Passwords

• No password yet? Ways to sign in shows No password set with Add a password; you confirm it is you first.
• Change or reset. Use Forgot password? on the sign-in page; the emailed link opens a form to set a new one. Expired or reused links say so and offer a new one.
• Unproven passwords are removed. If you set a password before verifying your email and then sign in by link or code, the password is dropped and Settings → Account tells you, with a button to add a new one.

Language and appearance

Settings → General. Language offers ten locales: English, Swahili, Spanish, French, German, Portuguese, Italian, Japanese, Chinese and Arabic. Appearance is System, Light or Dark; Layout is Default, Compact or Wide. The same section holds your profile, instructions for Akili, voice style and speed, distance units for Maps, and notification toggles for response completions, dispatch messages, email and SMS.

Privacy and memory

Settings → Privacy (?settings=privacy) is where your stored data is listed and removed.

• Memories. Each remembered fact can be edited or deleted and marked private (never shared with assistants or exports) or shared (assistants you approve can read it). Clear all memories wipes them after a confirmation.
• Memory preferences. Whether Akili remembers at all is a plan feature and can be disabled by an organization policy; categories and a per-member cap come from the same policy.
• Shared chats. Lists every chat with a public share link and lets you unshare it.
• Delete all chats. Removes every conversation in the workspace after an inline confirmation.

Your context: export, import and encryption key

Settings → Your context (?settings=context) treats your profile, memories, chats, projects and agents as a package that belongs to you.

Take a copy

Request export builds a package kept for seven days; download it from the list. Seal with a passphrase (at least twelve characters) produces a package that opens only with that passphrase, here or on another Akili; Akili keeps no copy, and an organization can require sealing. Exports per day are a plan limit.

Import a package

Bring an Akili Context Package (.zip) or a ChatGPT or Claude export (.json). Memories merge with what you have; chats are read for facts. Importing needs a paid plan and is limited per day.

Encryption key

• Held by Akili (default). Memories are encrypted at rest with a key that is yours alone; Akili holds the wrapping key so nothing has to be typed. Rotate key re-encrypts in the background.
• Hold my own key. Where the organization allows it, you get a 24-word recovery phrase and Akili keeps the unlocked key only for the session. A new device asks for the phrase once; Lock now and Hand back to Akili are available. An organization may require an escrow copy for its recovery officers, and you are notified if it is ever used.
• Withdraw key. Deletes every unlocked copy; within a minute every memory becomes unreadable to everyone until you restore access with the phrase. Chat keeps working without memories.

Assistants with access

External assistants that asked to read your context appear here with the scopes you approved (profile, memories excluding private ones, chats, add memories), when they last read and how many times. Revoke removes access at once; every read is logged.

API keys

Create, list and revoke your platform API keys in Settings → API keys (?settings=api-keys). A key is workspace-scoped: it acts in the workspace it was created in. The number of keys is a plan limit, and an organization can switch member API keys off by policy, in which case the tab says so. From code, the same key is created with POST /api/api-keys/create while signed in.

1. Step 101

   Name it and set an expiry

   Expires after 30, 90 or 365 days (90 by default). Shorter is safer; you can always create another.
2. Step 202

   Choose the access

   Tick none of the scopes for full access (everything the account can do), or pick only what the integration needs: social publishing read or write, flows read, run or write. Scopes only restrict what the key can call.
3. Step 303

   Copy it once

   Copy your new API key now. It is shown once; store it somewhere safe. Revoke a key the moment it leaks or when the integration that used it is retired.

• Hygiene. One key per integration, the narrowest scopes that work, an expiry you will notice, and rotation by creating the new key before revoking the old.
• Keys made before scopes existed keep full access; recreate them scoped.
• SSO requirement. While an organization requires SSO, its API keys are refused as well.
• Provider keys are different. Keys for OpenAI, Azure and the like are an organization setting; see Organization.

Deleting chats and your account

• Chats: delete one from its menu, or everything with Settings → Privacy → Delete all chats.
• Memories: delete one fact, or Clear all memories.
• Account: Settings → Account → Delete account opens an email to support@ntegral.com with the subject “Delete my Akili account”; support completes the deletion. Take a context export first if you want a copy.

Good to know

• Account security checklist. The top of Settings → Account counts what is left to do: verified email, two-factor, passkeys, recovery codes and more than one way to sign in. Items it cannot check from the browser say so.
• Signing in from an app’s built-in browser? Google sign-in can be blocked there; copy the link and open it in Safari or Chrome.
• Sign-in links are single-use. A magic link or verification link that was already opened, or came from an earlier request, is refused; request a new one and use the latest email.
• Organization-managed access. If your email domain is claimed by an organization, magic-link sign-in needs an invitation; press Request access to notify its administrators.