Skip to main content

​
Set and rotate your dashboard password

The password card under Settings → Profile is where you set or change the password you use to sign in to the Orbit dashboard. Two situations bring you here: you sign in with a password and want to rotate it, or you sign in only through Google or your identity provider and need a password for the first time, for a fallback login or a break-glass scenario. Both paths live on the same card and both enforce the same rules. This guide covers what the card asks of you, what happens on every device when you save, and the one thing rotation deliberately does not do: touch your API keys.

​
Where the card lives and what it asks

Open Settings → Profile and scroll to the password card. It reads one of two ways, depending on your account:
  • Change password — you already have a password. The card asks for your current password, then the new one twice.
  • Set a password — your account was created through Google or SAML SSO and has no password yet. There is no current-password field; instead Orbit re-verifies your identity before the save, described below.
If your organization enforces SAML single sign-on (the enforce-SSO step in SAML SSO enrollment), password sign-in is disabled for every member, so a password set here will not sign you in. Keep using SSO unless your admin tells you otherwise.

​
The identity check before a first password

When you set a first password on an OAuth- or SSO-only account, saving triggers an identity re-verification: a step-up challenge, the same one Orbit uses for other sensitive account changes, asks you to prove it is really you before the password is stored. The point is stolen-session protection: someone holding a live session still cannot add a password and lock you out of your own account. Complete the challenge and the save proceeds. Dismiss it instead and nothing changes: the card reports that verification was cancelled and invites you to try again. The challenge mechanics in general are covered in Understanding re-verification challenges. When you rotate an existing password, the current-password field is itself the proof, so no extra challenge appears on that path.

​
The complexity bar: 12 characters, everywhere

Orbit applies the same bar on every surface where you choose a password: sign-up, password reset, and this card.
  • At least 12 characters
  • At least one uppercase and one lowercase letter
  • At least one number and one symbol
  • No run of four or more sequential or repeated characters (1234, aaaa, wxyz)
  • Not a password that has appeared in a known data breach
As you type, the card shows the first rule you have not met yet, so you clear the criteria one at a time instead of guessing at submit. If you have seen hosted sign-in widgets elsewhere accept eight characters, that lower bar is not what Orbit applies. Orbit checks your password against its own rules before the password is stored, and any password under 12 characters is rejected here regardless of what a generic widget would allow.

​
What rotation signs out, and what it does not

When the save succeeds, two things happen in sequence:
  1. Every other device is signed out immediately. Phones, tablets, and other browsers holding a session lose it on the spot.
  2. This device is signed out too. The card confirms the update, then returns you to the sign-in page so you log back in with the new password.
Plan for both when you rotate: you will re-authenticate on the device you rotated from, and anyone else signed in as you will need the new password. Two things deliberately survive a rotation:
  • API keys stay valid. Rotating from the password card does not revoke API keys, so server-to-server integrations keep working. The one-click “revoke all my API keys” offer belongs to the reset flow: after you reset a forgotten or compromised password by email, the follow-up email offers to revoke every key in one click (see Password reset and API-key revocation). Rotating from Settings → Profile does not present that offer. If you are rotating because you suspect compromise, revoke the keys yourself as part of the same response.
  • A “password changed” entry lands in your notifications feed, alongside a security email and push, so an unexpected rotation is visible the moment it happens.

​
If the save fails

​
See also