Your account

Your K-Block account is personal: it belongs to you, not to an organization. One account can be a member of several organizations, with a different role in each.

This page covers everything about the account itself: creating it, signing in, sessions, passwords, your e-mail address, the personal K-Block identity you need to approve requests, and the keys stored in your browser. You manage most of it on the Account page, which you open from the account menu with Account settings.

Create an account

1. Sign up

   Open the dashboard and select Create one on the sign-in page, or go to Create your account. Enter your Name, E-mail and a Password of 12 to 256 characters, and confirm the password.

2. Check your e-mail

   The page says "Sign-up request accepted". It says the same for every address, so it never reveals whether an address already has an account. If the address is new, you receive a verification link, valid for 24 hours. If it already has an account, you receive a note on how to sign in or reset the password instead.

3. Verify the address

   Open the link. On Verify your e-mail address, enter Your account password and select Verify e-mail address. The page shows E-mail address verified.

4. Sign in

   Sign in with your address and password. A new account can sign in only after its address is verified.

If you are not a member of any organization yet, the dashboard takes you to create one; you become its owner. See the Setup guide for what to do next. To join an existing organization instead, ask an owner or admin for an invitation (see Members).

No verification e-mail?

Check your spam folder first. Then use Send a new verification link (on the sign-in page after a failed sign-in, select Resend it). A new link, once sent, replaces the earlier ones. You can ask once a minute (the button counts down), and the answer is the same for every address. If an address already received many K-Block e-mails within the hour, no new link is sent; the link you already have keeps working.

Sign in and sign out

Sign in with your e-mail address and password. If sign-in fails, the page shows Sign-in failed with one message for every reason: a wrong address or password, an address that is not verified yet, or a disabled account. K-Block does not say which, so nobody can probe which addresses have accounts.

After too many attempts, sign-in is rate limited: the button is disabled and shows how long to wait.

To sign out, open the account menu and select Sign out. This ends the session in this browser only. Your keys stay in this browser after you sign out; to remove them, see Shared or borrowed computers.

If K-Block could not end the session, the page says Sign-out failed: you are still signed in on this browser. Try again, and do not leave a shared computer until signing out succeeds.

Sessions

A session is what keeps you signed in in one browser.

• It ends after 12 hours without activity, and in any case 7 days after you signed in. You are then sent to the sign-in page, and back to the page you were on after signing in.
• Signing in again in the same browser replaces that browser's previous session.
• Changing your password signs out your other sessions. Resetting it, or using This wasn't me on an e-mail change, signs out every session, including the current one.
• Role changes in an organization apply to your next request; you stay signed in.
• All tabs of the dashboard in one browser share its session. When you sign in or out in one tab, the other open tabs follow.
• A change you prepared in one tab is never submitted for another account. A page makes changes only for the account it was showing when you prepared them. If the browser was signed in to another K-Block account in another tab or window in the meantime, the change fails with SESSION_CHANGED: it is not carried out for the other account, and nothing is recorded, not even an object you already signed. The message says "The account signed in to this browser changed (in another tab or window), so this was not done and nothing was recorded. The page now shows the account that is signed in: to act as the previous account, sign in to it again; otherwise check the page, then try again."

The dashboard has no list of your active sessions in this version. To end sessions on other devices, change your password.

Change your password

On Account, in the Password card, enter your Current password, a New password (12 to 256 characters, different from the current one) and Confirm new password, then select Change password.

Your other sessions are signed out, and a pending e-mail change is cancelled (its links stop working). The card warns you before saving if a change is pending. If your address is verified, K-Block sends it a notice, "Your K-Block Cloud password was changed": if you did not change it, reset the password with Forgot password? at once — a reset link works even after the password was changed.

Reset a forgotten password

1. Request a link

   Select Forgot password? on the sign-in page. On Reset your password, enter the address you sign in with and select Send reset link. The answer is the same whether or not the address has an account.

2. Set a new password

   Open the link from the e-mail within 1 hour. On Set a new password, enter and confirm a new password.

3. Sign in again

   The page shows Password changed: every session of your account was signed out, on all devices, and the address the link was sent to is verified. Sign in with the new password. K-Block also sends that address a notice, "Your K-Block Cloud password was reset": if you did not reset it, someone can read your mailbox — secure the mailbox first, then reset the password again.

A reset also verifies your address, since you proved you receive mail there, and cancels a pending e-mail change.

Change your e-mail address

On Account, in the E-mail address card, enter the New e-mail address and your Current password, then select Change e-mail address.

For a verified account, a change needs two links, both valid for 24 hours, each used with your password, in either order:

1. the confirmation link sent to the new address, which proves you receive mail there;
2. the approval link sent to your current address, which proves the current owner of the account agrees.

Until both are used, you keep signing in with your current address, and the card shows Change pending — both links are needed.

If another account already uses the new address, that address receives a notice instead of a link, and nothing changes. A wrong current password is refused with INVALID_CURRENT_PASSWORD. If K-Block cannot send one of the links, the change is cancelled at once and the request answers EMAIL_DELIVERY_FAILED: wait a minute and try again. If it keeps failing, contact K-Block support with the error code and the request ID shown in the error.

If you did not ask for the change

Someone who knows your password can request a change. The page that the approval link (sent to your current address) opens has a This wasn't me section: select This wasn't me — cancel the change, then Cancel the change and sign out everywhere. It cancels the change and signs out every session, without a password. Then reset your password: whoever asked for the change knew it. Changing your password from the Account page also cancels the change.

Expired and used links

Every e-mail link works once. When a link cannot be used, the page shows This link cannot be used: it is invalid, has expired, was already used, or was replaced by a newer link. The page offers a way to get a new one.

Links that need your password (verification and e-mail change) stop working after 5 wrong passwords. Until then, a wrong password shows Wrong password and the link keeps working. If you open a newer link in the same tab, it replaces the older one.

Personal identity

Your personal K-Block identity is a signing key that belongs to you. When you approve or reject a request, the dashboard signs the decision with it in your browser. You need one to decide approvals. See Identities and KIDs.

The Personal K-Block identity card on Account is available once your address is verified.

1. Generate and bind

   Under Generate your personal identity, optionally enter a Label (optional), then select Generate and bind. A new key is generated in this browser and bound to your account. The private key is kept in this browser, and in the key backups you export; K-Block Cloud receives only its public part.

2. Back it up

   Export a key backup right away (see Key backup). A key that exists only in this browser is lost with it.

The card lists Identities bound to your account (with how many of your 5 are active), each marked Key in this browser, Key not in this browser or Revoked, and Keys stored in this browser, each Bound, Not bound or Revoked. A stored key that was never bound shows Bind to my account; a revoked one can only be deleted.

• Revoke an identity when its key may be lost or exposed. It is permanent and covers every organization: K-Block no longer accepts approvals or rejections signed with it, and it can never be bound again. Decisions it already signed stay valid. Revoking is recorded in K-Block Cloud only: it does not delete copies of the key from browsers or backups.
• Delete from browser removes a private key from this browser only. The identity stays bound to your account and can still sign wherever another copy of its key exists, such as an imported backup; revoke it to stop that. Without a backup you cannot sign with it here again.

Once this browser signs with your identity, the card no longer offers to generate one right away: Generate another identity explains when a second identity is useful (a separate device you want to revoke on its own) and opens the form. If your identity's key is in another browser, the card offers to import its key backup before generating a new one.

Signing from another browser or device

Signing in on another browser or device gives you your account, not your keys: that browser cannot sign until it holds one. Either import a key backup there (the same identity: requests already pending can be decided from either browser), or generate a new identity there (a separate identity you can revoke on its own; only requests created after it is bound list it). If you lose a device, see If you lose a device. See also Identities and KIDs.

The Settings page of each organization shows a summary of your personal identity, and owners also manage the organization principal there (see Settings).

Key backup

Your private keys exist only in the browsers where they were generated or imported, and in the backup files you export. K-Block Cloud has no copy and cannot recover them. The Key backup card exports and imports keys entirely in your browser; it sends nothing to K-Block Cloud.

A backup is a copy of your signing authority: anyone who has the file and its passphrase can sign with the keys in it, approvals as you and, with an organization principal, delegations as your organization.

• Export: tick the keys to export (the card lists the keys of your account stored in this browser), enter a Backup passphrase of at least 12 characters and confirm it, then select Download backup. Every backup is encrypted with its passphrase. Use a long passphrase you use nowhere else, such as several random words or one your password manager generates: anyone who gets the file can try to guess it. K-Block cannot reset the passphrase, and without it the backup cannot be restored.
• Import: choose the Backup file (up to 1 MiB), enter its Passphrase and select Import keys. The keys are added to this browser for your account. Nothing changes in K-Block Cloud: an imported identity is the same identity as before, and a revoked one stays revoked. A wrong passphrase, or an encrypted backup that was modified, is refused, and nothing is imported. A personal key, or an organization principal stored for your account, that is already here is left as it was, unless this browser can no longer decrypt its stored copy: the import then repairs it. An organization principal that another account of this browser profile stored is used for your account from then on. A personal key always stays with the account it belongs to: a personal key of another K-Block account is stored, but never listed or used for you, and the message says so.

Use a backup to sign from a second browser or device, to hand the organization principal to another owner or admin (they import it in their own browser, signed in to their own account), and to restore keys after the browser's data is cleared. Keep the file and the passphrase apart. See Key backup for what an import stores in detail.

Keys in this browser

The This browser card on Account shows what this browser profile holds for you:

The dashboard asks the browser to keep its storage after you generate or import a key, and the Storage row then shows the browser's answer. When the card shows May be cleared by the browser, select Ask the browser to keep them to ask again; the browser decides, and some browsers ask you first. If the browser declines, the card says "The browser did not agree to keep this site's data. Keep a key backup somewhere other than this browser." Keep a key backup in any case.

The key lists of every dashboard tab open in this browser update when a key is added or removed in another tab.

Keys stay in this browser after you sign out, and after you close and reopen the browser. They are deleted when this site's data is cleared. A private or incognito window discards its keys when you close it; an identity you bound there stays bound to your account until you revoke it. Anything that runs code on the dashboard's pages in this browser profile, such as a malicious browser extension, can use and copy the keys stored there. See How the browser stores keys.

Shared or borrowed computers

Use a browser profile of your own for K-Block. Another account that signs in to the same profile never sees or uses your keys in the dashboard, but anyone who controls the profile can copy them. The Signing keys section of Account says so: "Keys stay in this browser after you sign out. The dashboard never uses them for another account that signs in to this browser profile, but anyone who controls the profile can copy them: use a browser profile of your own for K-Block, and remove your keys before you leave a shared or borrowed computer."

Before you leave a shared or borrowed computer:

1. Make sure a key backup of your keys exists somewhere other than that computer. If you export one there, save the file to storage you take with you, and do not leave a copy of it on the computer.
2. Select Remove all my keys from this browser… on the This browser card and confirm. It removes every key of your account that this browser holds at that moment, including one added in another tab since the page loaded. If any key is left, the card says "… of your keys could not be removed from this browser. Try again.": do so before you leave.
3. Sign out, and check that signing out succeeded.

The card's own hint says the same: "Before you leave a shared or borrowed computer: make sure a key backup of your keys exists somewhere other than this computer, remove your keys from this browser, then sign out."

Removing keys changes nothing in K-Block Cloud: your identities stay bound to your account, and a principal stays your organization's principal. If you cannot remove them, or you are not sure the computer is safe, treat the keys as exposed and follow If you lose a device.

If you lose a device

Losing a device deletes nothing: the keys stored in its browser stay on it, and it may still be signed in to your account. From another browser:

1. End its session

   Change your password on Account. This signs out your other sessions, including the one on the lost device, which would otherwise stay valid until it expires (see Sessions). If someone else may know your password, reset it instead (Forgot password? on the sign-in page), which signs out every session.

2. Revoke its personal identities

   In Personal K-Block identity, revoke every identity whose key was on that device. The list does not show which device a key is on: if you are not sure, revoke each one marked Key not in this browser that you cannot account for.

3. Replace the principal if the device held it

   If the device's browser held a copy of the organization principal's key, whichever account stored it, an owner replaces the principal under Settings (see Replace the principal), and owners or admins sign a new delegation for every agent.

4. Sign again from this browser

   Import a backup of an identity you did not revoke, or generate a new one. Approval requests created before that list only the identities that existed then: if all of yours on a request are revoked, another listed approver decides it, or it expires.

Account settings that do not exist

In this version, the Account page does not let you edit your name, list or end individual sessions, or delete your account.

Errors

When K-Block cannot send e-mail, a new verification link, a password reset or an e-mail change is refused without a code: the error says "K-Block cannot send e-mail right now, so no message was sent." Try again later, and if it keeps happening, contact K-Block support and give them the request ID shown in the error.

See Error codes for the full list.

Related pages