Account

Your account is your identity on Bastide: an email address, a password, possibly a second factor, and the tokens you issue for your scripts. This page explains how to open it, sign in, protect it and manage what acts in your name. Everything is set on the console's Compte (Account) screen, which applies whichever organization is open.

Create an account

1. Open https://console.bastide.app/creer-un-compte.
2. Enter your email address and the name of the organization to create (2 to 100 characters), tick the beta terms, then "Recevoir le lien" (Get the link).
3. The email you receive carries a single-use link, valid for seven days, to Ouvrir un compte (Open an account) (/ouvrir-un-compte).
4. Choose your password; the organization's name can still be corrected there. "Ouvrir le compte" (Open the account) creates the account and the organization, of which you become Owner.

The request creates nothing by itself: it sends an invitation to the address given, and opening the email proves that the address is yours. The response is the same whether or not the address already has an account: it does not reveal who is registered. For the same reason, an account that is already open receives no link.

Three limits apply to requests: three links per hour for the same address, ten requests per hour from the same IP address, and three hundred sign-ups per day for the whole platform.

Join an existing organization

If a member invites you, their email leads to Rejoindre une organisation (Join an organization), which shows the organization, the role and who invited you. Without an account, you choose your password there and go straight in; with an account, you join under your session. See Organizations.

Through the API

Sign-up sits outside the operation registry, since the person has no identity yet:

curl -X POST https://api.bastide.app/v1/account/signup/request \
  -H "Content-Type: application/json" \
  -d '{ "email": "you@example.com", "organizationName": "My team" }'

The response is 202 in every case. The link received is then accepted with POST /v1/account/signup, with the invitation token (ins_…), the password and, optionally, the organization's name.

Sign in

The Connexion (Sign in) screen offers three routes.

With a password

Your address and password, then "Ouvrir la console" (Open the console). You get a session: it lasts eight hours at most and closes after sixty minutes without activity. If your account belongs to several organizations, the console asks you to choose, starting with the last one chosen on this device.

If your account has a second factor, the right password is not enough: the screen then asks for the code from your app, your passkey, or one of your recovery codes. This second step is valid for five minutes and five attempts; after that, you start again with the password.

With a personal token

"Entrer avec un jeton personnel" (Sign in with a personal token) opens the console with a pat_… token. The token stays in the tab and disappears when it is closed. It is the only route for an account that does not have a password yet. Under a token you cannot change your password or your second factors: those actions need a session opened with a password.

With single sign-on

"Se connecter avec l'authentification unique" (Sign in with single sign-on) asks for your organization's identifier (slug) and sends you to its OpenID Connect identity provider, then brings you back. Only accounts provisioned by the organization's directory (SCIM) can sign in this way, and Bastide's second factor is still required. Self-service configuration of single sign-on is not available yet. See Single sign-on.

Failed attempts

Five failures in fifteen minutes, for one account from one IP address, make the next attempt wait: sixty seconds at first, then twice as long with each further failure, up to fifteen minutes. The response is the same for an unknown address, a suspended account and a wrong password.

The password

• 12 to 256 characters.
• It must not repeat your email address or appear among compromised or overly common passwords. The check is done locally, without calling a third-party service.
• Only a hash is kept.

To change it: Compte, "Mot de passe" (Password) section: the current one, the new one, then the new one again. Your other sessions are closed; this one stays open.

Lost password or second factor

Below the Connexion form, "Mot de passe ou second facteur perdu ?" (Lost password or second factor?) leads to the /reinitialiser page, which offers two requests:

At most three links are sent per account, per kind and per hour. The response never says whether the address has an account. Losing both the password and the second factor goes through support: this is deliberate.

The second factor

Compte, "Sécurité" (Security) section. Two kinds of factor:

• An authenticator app (six-digit codes, renewed every thirty seconds): "+ Ajouter une application d'authentification" (Add an authenticator app), your current password, then the QR code or the key to type in, then a first code to confirm. A factor not confirmed within fifteen minutes does not exist.
• A passkey (security key, fingerprint, phone): "+ Ajouter une clé d'accès" (Add a passkey), your current password, then the browser's ceremony.

When your first factor is confirmed, ten recovery codes are shown, once only: store them offline. Each works once, in place of the app's code. "Émettre de nouveaux codes" (Issue new codes) produces ten more, and the old ones stop working. You can hold five factors at most.

Adding or removing a factor requires your current password, and closes your other sessions. The last factor of an account that holds the Maintainer, Administrator or Owner role cannot be removed.

Warning. Writing SQL, running schema migrations and managing backend keys require a second factor, in every organization. A role that grants them (Maintainer, Administrator, Owner) can only be given to an account that holds a confirmed factor.

When the organization requires it

The Owner or the Security role can require a second factor, in the organization's Réglages (Settings), "Second facteur obligatoire" (Mandatory second factor) card. The requirement applies to the Owner, Administrator and Security roles. A fourteen-day grace period runs; reminders are written to the audit log before it ends. After the grace period, an account with one of those roles and no confirmed factor is refused in the organization (second_factor_required), through its session as through its tokens. Enrolling a factor restores access at once.

A service account cannot hold a factor: it is exempted by name, with a reason (20 to 500 characters) and an expiry of ninety-two days at most.

Sessions

Compte, "Sessions" section: every open console session, where it was opened from, its last activity and how long it remains valid; "Cette session" (This session) marks yours. Closing a session makes it be refused on the next call. Changing your password or second factor closes the other sessions; a change of role closes them all.

Personal tokens

A personal token is what you give to a script, an integration or the command line: it calls the API in your name, within the limit of your rank and of the scopes you give it. It belongs to you, not to the organization: an administrator cannot see your tokens.

Compte, "Vos jetons" (Your tokens) section, then "Frapper un jeton" (Issue a token):

1. À quoi il sert (What it is for): the name you will read in the list.
2. Durée de vie (Lifetime): 7, 30, 90 (suggested), 180 or 365 days. No token lasts for ever.
3. Ce qu'il pourra faire (What it can do): at least one scope. The console only offers the scopes your own token holds.

The token is shown only once: copy it before "Je l'ai copié" (I have copied it). Bastide keeps only a hash. Check that it works:

curl -H "Authorization: Bearer $BASTIDE_JETON" https://api.bastide.app/v1/account/personal-access-tokens

Its scopes and expiry are fixed at creation: it cannot be edited, only revoked. A token unused for ninety days is disabled, after a notice; "Réactiver" (Reactivate) makes it usable again with the same scopes and expiry. At most fifty tokens can be active per account.

For the command line, bastide login issues the token for you; in continuous integration, put it in the BASTIDE_TOKEN variable. For an integration that should not depend on a person, prefer a service account.

Authorised MCP clients

When an agent connects through OAuth, the console shows you the Autoriser un client MCP (Authorise an MCP client) page: who is asking, from which address, and for what. Compte, "Clients MCP autorisés" (Authorised MCP clients) section, lists each accepted client, its scopes and its last use; removing it makes its tokens fail on the next call. See MCP.

Account notifications

Compte, "Notifications" section: for the open organization, four kinds of event, and for each the channels that notify you (email, web notification, app).

A ticked box is saved at once. Devices registered by the mobile app are listed and removed in the same place. See Notifications.

Notices received

Compte, "Avis reçus" (Notices received) section: the messages the platform has sent to your account (a dormant token, a second-factor reminder, a link, an invitation) and what became of them: delivered, pending, rejected by the mail server or abandoned. Useful when an expected email does not arrive.

Closing your account

Self-service account closure is not available yet, nor is deleting an organization. Write to support: during the beta, your data is returned to you on request, then erased. Before that, you can delete your projects (see Create a project) and produce an exit archive (see Leave Bastide).

Common errors

See also

• Quickstart
• Organizations
• Security
• Service accounts

Report a mistake on this page