Sign-in and devices

Manage passwords, passkeys and signed-in devices, or follow this guide to revoke a session or recover access.

Calends has a single owner: one password, and as many passkeys as you like. Everything here is under Settings → Security.

Password

• At least 8 characters, stored as a salted PBKDF2-SHA256 hash; the server never keeps it in plain text.
• Change password asks for the current one first. Afterwards, every device except the current one is signed out.
• The first password needs the setup token; see First-time setup.

Forgot your password

There is no email reset link. Change password requires your current password even on a signed-in device. A working passkey can still sign you in so you can export a backup first.

To reset the password, delete its record in the database you control, then initialize it again with SETUP_TOKEN. This deletes the password hash, keeps your ledger, and does not itself revoke existing sessions or passkeys.

1. Make sure you can retrieve or reconfigure SETUP_TOKEN, and back up the database.

2. Run the command for your deployment from its directory:

   # Cloudflare
   npx wrangler d1 execute DB --remote --command "DELETE FROM kv WHERE key = 'auth'"
   
   # Docker (with the default DATA_DIR of /data)
   docker exec calends node_modules/.bin/wrangler d1 execute DB --local --persist-to /data \
     --command "DELETE FROM kv WHERE key = 'auth'"

3. Open /admin, enter the setup token and set a new password.

4. Review Signed-in devices and your passkeys, and remove access you no longer need.

Passkeys

After Add passkey, choose Sign in with passkey on the sign-in page to use Face ID, Touch ID or your device passcode. The list shows when each passkey was added and last used; remove the ones you don’t need.

Passkeys are tied to your site’s domain and need HTTPS. After moving to a new domain, old passkeys won’t work there: sign in with your password and add new ones on the new domain.

Signed-in devices

Signed-in devices lists every active session: browser and OS, how it signed in (password or passkey), when, when it was last active, and an approximate location from the IP (not always accurate). The current one is marked This device.

• Sign out on a device ends that session immediately. You can’t remove the current device this way — use Sign out from the app menu instead.
• Sign out all other devices keeps only the current one.
• Max signed-in devices: 1, 2, 3, 5, 10 or 20; 10 by default. Past the limit, the device inactive the longest is signed out automatically; lowering the limit applies immediately.

Each session lasts 180 days. The session token lives in an HttpOnly, SameSite=Lax cookie (Secure over HTTPS), and the server only stores its hash.

Rate limiting

After 6 failed attempts from the same IP within 15 minutes, that IP is locked out for a while (“Too many attempts. Try again in 15 minutes.”). Password sign-in, passkey sign-in and first-time setup share this limit.

On Cloudflare, Calends reads the visitor’s real IP from Cloudflare’s headers. When self-hosting behind a reverse proxy, set TRUST_PROXY=1 so X-Forwarded-For is trusted; otherwise every visitor looks like the proxy’s IP. Don’t set it when there’s no proxy in front, or anyone could forge the header to get around the limit. See Configuration.