Your account and sign-in

When your Savorum has sign-in turned on, you have your own account. Set up at least two ways back in, such as a passkey and a printed set of recovery codes, so losing one device never locks you out. Everything here is under Your account.

Add a passkey

A passkey lets you sign in with your phone, computer, password manager, or security key instead of a password.

1. Open Your account → Sign-in and security.
2. Under Passkeys, give the passkey a name you’ll recognize, such as “Work laptop”.
3. Choose Add passkey and follow your device’s prompts.

To sign in with it, choose Sign in with a passkey. You don’t need your login name: your device offers the passkeys it holds for this site.

Save recovery codes

Recovery codes get you back in when you lose your other ways to sign in.

1. On Sign-in and security, choose Generate 10 recovery codes.
2. Save them right away, in a password manager or on paper. They’re shown only once, and nobody can show them again, not even your administrator.

Generate replacement codes makes a new set, and every old code stops working at once.

To use a code, choose Lost access? Use a recovery code on the sign-in page, enter your login name and an unused code, and choose Recover Savorum account. Each code works once.

Manage how you sign in

You can have several sign-in methods: a password, passkeys, recovery codes, and any sign-in service your administrator has connected. Your recipes and libraries belong to your account, whichever you use.

On Sign-in and security:

• Under Sign-in methods, choose Add a sign-in provider to link a sign-in service, or Remove to drop a method. Removing one signs you out on all devices. Savorum won’t let you remove your last way in.
• Under Active sessions, check each browser signed in to your account. Choose Revoke session for any you don’t recognize, or Sign out all other sessions.
• Under Password, choose Change password. This signs you out everywhere.

Create a personal API token

A personal API token lets another program, such as a script or a home automation, use your libraries as you, with only the permissions you choose.

1. Open Your account → API tokens.
2. Under Create a token, enter a Token name, then choose its Permissions, Libraries, and when it Expires after.
3. Choose Create token and copy the token. It’s shown only once.

Each permission stands alone, so choose both a viewing and an editing permission if the program needs both. View and export recipes also covers printing, and recipe suggestions and lookups. View books, tags and categories also covers book and saved-meal suggestions and lookups. Import recipes also covers import previews and background jobs.

The program sends the token with each request:

curl --fail --header "Authorization: Bearer $SAVORUM_TOKEN" \
  --header "X-Savorum-Library: $SAVORUM_LIBRARY" \
  https://recipes.example.com/api/v1/recipes

Without X-Savorum-Library, Savorum uses the first library the token can reach. The API guides cover the rest.

To replace a token without a gap, create the new one, switch the program to it, then revoke the old one under Your tokens. Revoking takes effect at once.

Good to know

• Adding, renaming, or removing a passkey, and replacing recovery codes, only work within five minutes of signing in. If more time has passed, sign out and back in. Signing in with a recovery code counts.
• After several wrong recovery codes, wait 15 minutes before trying again.
• Recovery codes restore your Savorum account only, not your account at a sign-in service. If you sign in only through such a service, you can create codes only if your administrator allows it.
• Passkeys are tied to your Savorum’s web address. If the address changes, they stop working, so keep another way in.
• Failed sign-ins slow down for a while, but never lock your account. If sign-in says it’s busy, wait a moment and try again.
• A session ends after 30 days without use, or 180 days in total, unless your administrator changes this.
• A token can only do what you can do, in libraries you still belong to. It can never manage accounts, memberships, settings, or webhooks, empty the trash in bulk, or act as an administrator.
• A token made while signed in through a sign-in service stops working if that service is disconnected.
• Tokens expire after 90 days by default, and after at most 365, unless your administrator allows longer.

Next: Review measurements.