> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Set and rotate your dashboard password > Set a first password on an OAuth- or SSO-only account, or rotate an existing one, from Settings → Profile: the identity step-up before the save, the 12-character complexity bar, what rotation signs out on every device, and why API keys survive. # Set and rotate your dashboard password The password card under **Settings → Profile** is where you set or change the password you use to sign in to the Orbit dashboard. Two situations bring you here: you sign in with a password and want to rotate it, or you sign in only through Google or your identity provider and need a password for the first time, for a fallback login or a break-glass scenario. Both paths live on the same card and both enforce the same rules. This guide covers what the card asks of you, what happens on every device when you save, and the one thing rotation deliberately does not do: touch your API keys. ## Where the card lives and what it asks Open **Settings → Profile** and scroll to the password card. It reads one of two ways, depending on your account: * **Change password** — you already have a password. The card asks for your current password, then the new one twice. * **Set a password** — your account was created through Google or SAML SSO and has no password yet. There is no current-password field; instead Orbit re-verifies your identity before the save, described below. If your organization enforces SAML single sign-on (the enforce-SSO step in [SAML SSO enrollment](https://docs.orbit.devotel.io/guides/saml-sso-enrollment.md)), password sign-in is disabled for every member, so a password set here will not sign you in. Keep using SSO unless your admin tells you otherwise. ## The identity check before a first password When you set a first password on an OAuth- or SSO-only account, saving triggers an identity re-verification: a step-up challenge, the same one Orbit uses for other sensitive account changes, asks you to prove it is really you before the password is stored. The point is stolen-session protection: someone holding a live session still cannot add a password and lock you out of your own account. Complete the challenge and the save proceeds. Dismiss it instead and nothing changes: the card reports that verification was cancelled and invites you to try again. The challenge mechanics in general are covered in [Understanding re-verification challenges](https://docs.orbit.devotel.io/troubleshooting/reauth-challenge-flow.md). When you rotate an existing password, the current-password field is itself the proof, so no extra challenge appears on that path. ## The complexity bar: 12 characters, everywhere Orbit applies the same bar on every surface where you choose a password: sign-up, password reset, and this card. * At least 12 characters * At least one uppercase and one lowercase letter * At least one number and one symbol * No run of four or more sequential or repeated characters (`1234`, `aaaa`, `wxyz`) * Not a password that has appeared in a known data breach As you type, the card shows the first rule you have not met yet, so you clear the criteria one at a time instead of guessing at submit. If you have seen hosted sign-in widgets elsewhere accept eight characters, that lower bar is not what Orbit applies. Orbit checks your password against its own rules before the password is stored, and any password under 12 characters is rejected here regardless of what a generic widget would allow. ## What rotation signs out, and what it does not When the save succeeds, two things happen in sequence: 1. **Every other device is signed out immediately.** Phones, tablets, and other browsers holding a session lose it on the spot. 2. **This device is signed out too.** The card confirms the update, then returns you to the sign-in page so you log back in with the new password. Plan for both when you rotate: you will re-authenticate on the device you rotated from, and anyone else signed in as you will need the new password. Two things deliberately survive a rotation: * **API keys stay valid.** Rotating from the password card does not revoke API keys, so server-to-server integrations keep working. The one-click "revoke all my API keys" offer belongs to the reset flow: after you reset a forgotten or compromised password by email, the follow-up email offers to revoke every key in one click (see [Password reset and API-key revocation](https://docs.orbit.devotel.io/guides/auth-password-reset-and-key-revocation.md)). Rotating from Settings → Profile does not present that offer. If you are rotating because you suspect compromise, revoke the keys yourself as part of the same response. * **A "password changed" entry lands in your [notifications feed](https://docs.orbit.devotel.io/notifications/overview.md)**, alongside a security email and push, so an unexpected rotation is visible the moment it happens. ## If the save fails | What you see | What it means and what to do | | - | - | | "Your current password is incorrect." | Only shown when rotating. Re-type your current password; attempts are rate limited, so wait a minute if you end up retrying in a loop. | | A rule reminder under the new-password field | The live complexity bar from the section above: length, character classes, sequences, or the breach check. | | A breach rejection with a `422` | The password appears in a known data breach even though it meets the complexity bar. Pick a different one; [Why your new password was rejected](https://docs.orbit.devotel.io/troubleshooting/password-reset-policy-rejected.md) covers the policy in detail. | | "Verification was cancelled. Your password was not changed — try again to continue." | You dismissed the identity check on the set-password path. Run the save again and complete the challenge; nothing was changed. | | "For your security, please sign in again before changing your password." | Your session is too old for a credential change. Sign in again, then return to the card. | | "That password is too long. Use fewer than 72 characters." | The upper bound on any password. Use a passphrase under 72 characters instead. | | "Too many attempts. Please wait a minute before trying again." | The rotation rate limit. Wait, then retry. | | A generic error with a short code in parentheses | A connectivity blip or an unrecognized rejection. Retry once; if it persists, contact [support@devotel.io](mailto:support@devotel.io) and quote the code. | ## See also * [Understanding re-verification challenges](https://docs.orbit.devotel.io/troubleshooting/reauth-challenge-flow.md): what the step-up asks for and why. * [Password reset and API-key revocation](https://docs.orbit.devotel.io/guides/auth-password-reset-and-key-revocation.md): the forgot-password path and the one-click key revocation. * [Security console](https://docs.orbit.devotel.io/guides/settings-security-console.md): the org-level controls, IP allowlist, SAML, SCIM, and 2FA. * [Notifications feed](https://docs.orbit.devotel.io/notifications/overview.md): where the password-changed alert lands. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.