User Settings

Every user has a personal settings page to manage their code review experience: change their password, choose a colour theme, manage their API token, and configure two-factor authentication. Click your username in the top navigation bar to open it.

Overview

The profile page lives at /profile. It is accessible to every logged-in user — no admin rights required. It contains four sections:

• User info — your avatar initials, display name, email address, and admin badge (if applicable).
• Change Password — update your password. Your current password is always required.
• Appearance — choose from four colour themes. The choice persists across sessions.
• API Token — generate or regenerate the token used to connect Claude Code or any MCP client.

Change password

Fill in the three fields in the Change Password section and click Save Password:

1. Current password — required as a security check.
2. New password — must be at least 6 characters.
3. Confirm new password — must match the new password exactly.

If you have forgotten your password entirely and cannot sign in, ask an administrator to reset it for you via Settings → Users → Edit.

Themes

The Appearance section shows four theme preview cards. Click any card to apply that theme instantly — no page reload required. Your choice is saved in the browser's localStorage and restored automatically on every visit, even after the browser is restarted.

Theme palette reference

Quick-toggle in the nav bar

The sun/moon icon button in the top navigation bar cycles through all four themes in order: Light → Dark → Dracula → Nord → Light. Hovering over it shows a tooltip with the current theme name. You do not need to open the profile page to switch themes.

API token

The API Token section shows your personal token used to authenticate with the built-in MCP server or the Codeveira REST API from external tools such as Claude Code — enabling AI-assisted code review directly from your editor.

Generating a token

If no token exists yet, click Generate Token. The token is displayed immediately — copy it now.

Copying the token

Click the Copy button next to the token. The button label changes to Copied! for 1.5 seconds to confirm.

Regenerating a token

Click Regenerate Token to invalidate the old token and create a new one. Any existing MCP or API connections using the old token will stop working immediately. Update your MCP configuration with the new token after regenerating.

Using the token with Claude Code

Add the following to your .claude/settings.json (or use claude mcp add):

{
  "mcpServers": {
    "codeveira": {
      "type": "http",
      "url": "https://your-codeveira-host/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_TOKEN"
      }
    }
  }
}

Replace YOUR_API_TOKEN with the token shown on your profile page, and your-codeveira-host with your actual hostname.

REST API Tokens Standard+

The single API token above is shared by every integration and never expires — fine for personal MCP use, but risky for CI pipelines and third-party tools, since revoking access for one integration means regenerating and re-distributing the token to every other integration too. The REST API Tokens section (below the API Token section, on Standard license or higher) lets you create as many separate, scoped tokens as you need for the REST API specifically.

Each token can be:

• Named — e.g. "CI pipeline" or "Terraform provider", so you know what to revoke later.
• Scoped to read-only or read-write — a read-only token can list and view repositories, reviews, and comments, but any write action (creating a review, approving, rejecting, closing, reopening, resolving a comment) is rejected.
• Restricted to a single repository — leave unset for access to every repository you can already reach; set it to limit the token to just one.
• Given an expiry — in days from creation, or left to never expire.

The raw token value is shown exactly once, immediately after creation — copy it right away. Codeveira never stores the plaintext, only a one-way cryptographic digest, so it cannot be recovered afterward even by an administrator with database access. Use it the same way as the MCP token above: Authorization: Bearer YOUR_SCOPED_TOKEN.

Revoke any token independently, at any time, from the same section — without affecting your other tokens or your legacy MCP token.

Two-Factor Authentication Standard+

Two-factor authentication (2FA) adds a TOTP verification step after your password login, protecting access to the code review platform. Any authenticator app works — Google Authenticator, Authy, 1Password, Bitwarden, and others.

The 2FA section is only visible on Standard license or higher. If your instance runs on the Free tier, this section does not appear.

Enabling 2FA

1. Open the Two-Factor Authentication section on your Profile page.
2. Click Set up 2FA.
3. Open your authenticator app and scan the QR code, or enter the key shown below it manually.
4. Type the 6-digit code from the app into the confirmation field and click Enable 2FA.

After enabling, every login will require the 6-digit code in addition to your password.

Disabling 2FA

If 2FA is not enforced by your administrator, a Disable 2FA button appears on the Profile page. Click it (and confirm) to remove 2FA from your account.

If your administrator has enabled the global 2FA requirement, the button is replaced by the message "2FA is required by your administrator and cannot be disabled." Contact your admin if you need to reset your authenticator app.

Lost authenticator access

If you lose access to your authenticator app, contact your Codeveira administrator. They can temporarily disable the global 2FA requirement, allowing you to log in and reconfigure 2FA from your profile with a new device.