Change your sign-in email

Your sign-in email is the address you sign in with, and the one Coritan sends your invoices and account notices to. Change it on the Profile tab of Settings. The new address takes over only once you open a link we email to it, so a mistyped address cannot lock you out.

• Sign in to the dashboard and have your password to hand.
• Have access to the inbox of the new address. No other Coritan account can sign in with it.

1. In the sidebar, select Settings. The Profile tab opens.
2. On the Sign-in email card, select Change email….
3. Enter the New email and your Current password.
4. Select Send confirmation link.

A message confirms it, such as Confirmation link sent to alex.morgan@example.com. The card then names the address it is waiting for, such as Waiting for alex.morgan@example.com, and the time the link stops working. Until someone opens the link, you keep signing in with your current address.

We also email your current address to say that a change was asked for, and which address it is for.

1. In the new inbox, open the email from Coritan and select its link. The link works for 24 hours.
2. If the dashboard asks you to sign in, sign in with your current address and password. The link works only for the account that asked for the change.

A message confirms it, such as Sign-in email changed to alex.morgan@example.com. Your password stays the same, and every device stays signed in.

While the card shows a change waiting, select Withdraw change. A message confirms Email change withdrawn., and the link we sent stops working.

To send a link to a different address instead, select Use another email…. The new request replaces the one before it, so only the newest link works. Changing or resetting your password also withdraws a change that is waiting.

You sign in with the new address from then on, and the Sign-in email card shows it. Invoices and account notices go to the new address too.

Incorrect password

The Current password is wrong. If you have forgotten it, reset it, then ask for the change again.

Too many wrong passwords. Wait a few minutes and try again.

The password was wrong 10 times in 15 minutes. Wait a few minutes. Your account is not locked, and you can still sign in.

Another account uses that address.

Another Coritan account signs in with that address. Choose another one, or sign in to that account and change its address first.

That is already your sign-in address.

You entered the address you sign in with now.

You asked for several address changes in the last hour. Wait a while and try again.

You can ask for 5 changes an hour. Wait an hour, then ask again.

This link does not work for this account. Sign in with the account that asked for the change.

You opened the link while signed in to another account. Sign out, sign in with the account that asked, and open the link again.

This link expired or was replaced. Ask for a new one in your account settings.

The link is more than 24 hours old, you asked for a newer one, you withdrew the change, or the password changed after you asked. Select Change email… to ask again.

This link was already used. Ask for a new one in your account settings.

The link already changed your address once, and the address has changed again since. Select Change email… to ask again.

Another account now uses that address. Choose another one.

Another account started using the address after you asked. Choose another address.

The email with the link does not arrive

Look in the spam folder of the new inbox, and check the address the card says it is waiting for. If it is wrong, select Use another email….

We emailed you about a change you did not ask for

Someone signed in to your account asked for it. Change your password straight away: a new password withdraws the change and signs out every other device.

• Update your profile
• Change or reset your password
• Sign out and end sessions

These routes are about the person signed in, so a team member who works in another account still changes their own address here. They ignore the X-Coritan-Account header.

GET /auth/me/email answers your address and the change that is waiting, if any:

curl https://api.coritan.com/api/v1/auth/me/email \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "email": "alex@example.com",
  "pending": {
    "new_email": "alex.morgan@example.com",
    "requested_at": "2026-09-26T09:12:40",
    "expires_at": "2026-09-27T09:12:40"
  }
}

pending is null when no change is waiting.

Send the new address and your password to POST /auth/me/email:

curl -X POST https://api.coritan.com/api/v1/auth/me/email \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"new_email": "alex.morgan@example.com", "password": "your password"}'

It answers email and pending as above, and a message such as We emailed a link to alex.morgan@example.com. Open it within 24 hours to finish the change.

The link in the email is https://www.coritan.com/dashboard/settings?confirm_email=.... Send its confirm_email value as token to POST /auth/me/email/confirm, with a token of the account that asked:

curl -X POST https://api.coritan.com/api/v1/auth/me/email/confirm \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"token": "token from the link"}'

It answers {"email": "alex.morgan@example.com", "message": "Your sign-in address is now alex.morgan@example.com."}. Another account's link answers 404, a used, expired or replaced link 410, and an address another account took in the meantime 409, each with the message in Troubleshooting.

POST /auth/me/email/cancel withdraws the change that is waiting, and answers how many it withdrew, such as {"cancelled": 1}.