# Change your sign-in email

> Move your account to another email address, which takes over once you open the link we send to the new inbox.

Source: https://www.coritan.com/docs/account/change-email/

In the dashboard:

- /dashboard/settings/profile: https://www.coritan.com/dashboard/settings/profile

Your sign-in email is the address you sign in with, and the one Coritan sends your invoices and account notices to. Change it on the **Profile** tab of **Settings**. The new address takes over only once you open a link we email to it, so a mistyped address cannot lock you out.

## Before you begin

- Sign in to the [dashboard](https://www.coritan.com/dashboard) and have your password to hand.
- Have access to the inbox of the new address. No other Coritan account can sign in with it.

## Ask for the change

1. In the sidebar, select **Settings**. The **Profile** tab opens.
2. On the **Sign-in email** card, select **Change email…**.
3. Enter the **New email** and your **Current password**.
4. Select **Send confirmation link**.

A message confirms it, such as `Confirmation link sent to alex.morgan@example.com.` The card then names the address it is waiting for, such as `Waiting for alex.morgan@example.com`, and the time the link stops working. Until someone opens the link, you keep signing in with your current address.

We also email your current address to say that a change was asked for, and which address it is for.

## Confirm the new address

1. In the new inbox, open the email from Coritan and select its link. The link works for 24 hours.
2. If the dashboard asks you to sign in, sign in with your current address and password. The link works only for the account that asked for the change.

A message confirms it, such as `Sign-in email changed to alex.morgan@example.com.` Your password stays the same, and every device stays signed in.

## Withdraw a change

While the card shows a change waiting, select **Withdraw change**. A message confirms `Email change withdrawn.`, and the link we sent stops working.

To send a link to a different address instead, select **Use another email…**. The new request replaces the one before it, so only the newest link works. [Changing or resetting your password](/docs/account/password/) also withdraws a change that is waiting.

## Result

You sign in with the new address from then on, and the **Sign-in email** card shows it. Invoices and account notices go to the new address too.

## Troubleshooting

`Incorrect password`
: The **Current password** is wrong. If you have forgotten it, [reset it](/docs/account/password/#reset-a-forgotten-password), then ask for the change again.

`Too many wrong passwords. Wait a few minutes and try again.`
: The password was wrong 10 times in 15 minutes. Wait a few minutes. Your account is not locked, and you can still sign in.

`Another account uses that address.`
: Another Coritan account signs in with that address. Choose another one, or sign in to that account and change its address first.

`That is already your sign-in address.`
: You entered the address you sign in with now.

`You asked for several address changes in the last hour. Wait a while and try again.`
: You can ask for 5 changes an hour. Wait an hour, then ask again.

`This link does not work for this account. Sign in with the account that asked for the change.`
: You opened the link while signed in to another account. Sign out, sign in with the account that asked, and open the link again.

`This link expired or was replaced. Ask for a new one in your account settings.`
: The link is more than 24 hours old, you asked for a newer one, you withdrew the change, or the password changed after you asked. Select **Change email…** to ask again.

`This link was already used. Ask for a new one in your account settings.`
: The link already changed your address once, and the address has changed again since. Select **Change email…** to ask again.

`Another account now uses that address. Choose another one.`
: Another account started using the address after you asked. Choose another address.

The email with the link does not arrive
: Look in the spam folder of the new inbox, and check the address the card says it is waiting for. If it is wrong, select **Use another email…**.

We emailed you about a change you did not ask for
: Someone signed in to your account asked for it. [Change your password](/docs/account/password/#change-your-password) straight away: a new password withdraws the change and signs out every other device.

## Related

- [Update your profile](/docs/account/profile/)
- [Change or reset your password](/docs/account/password/)
- [Sign out and end sessions](/docs/account/sessions/)

## With the API

These routes are about the person signed in, so a [team member](/docs/account/team-members/) who works in another account still changes their own address here. They ignore the `X-Coritan-Account` header.

### Read your sign-in email

[`GET /auth/me/email`](/docs/api/reference/client/account-settings/#op-get-api-v1-auth-me-email) answers your address and the change that is waiting, if any:

```bash
curl https://api.coritan.com/api/v1/auth/me/email \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

```json
{
  "email": "alex@example.com",
  "pending": {
    "new_email": "alex.morgan@example.com",
    "requested_at": "2026-09-26T09:12:40",
    "expires_at": "2026-09-27T09:12:40"
  }
}
```

`pending` is `null` when no change is waiting.

### Send the confirmation link

Send the new address and your password to [`POST /auth/me/email`](/docs/api/reference/client/account-settings/#op-post-api-v1-auth-me-email):

```bash
curl -X POST https://api.coritan.com/api/v1/auth/me/email \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"new_email": "alex.morgan@example.com", "password": "your password"}'
```

It answers `email` and `pending` as above, and a `message` such as `We emailed a link to alex.morgan@example.com. Open it within 24 hours to finish the change.`

| Status | Answer | Why |
| --- | --- | --- |
| `403` | `Incorrect password` | The password is wrong. |
| `422` | `That is already your sign-in address.` | The new address is the one you sign in with. |
| `409` | `Another account uses that address.` | Another account signs in with it. |
| `429` | `"error": "rate_limited"` | 10 wrong passwords in 15 minutes, or more than 5 requests in an hour. `retry_after_seconds` and the `Retry-After` header say how long to wait. |

### Confirm the change

The link in the email is `https://www.coritan.com/dashboard/settings?confirm_email=...`. Send its `confirm_email` value as `token` to [`POST /auth/me/email/confirm`](/docs/api/reference/client/account-settings/#op-post-api-v1-auth-me-email-confirm), with a token of the account that asked:

```bash
curl -X POST https://api.coritan.com/api/v1/auth/me/email/confirm \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"token": "token from the link"}'
```

It answers `{"email": "alex.morgan@example.com", "message": "Your sign-in address is now alex.morgan@example.com."}`. Another account's link answers `404`, a used, expired or replaced link `410`, and an address another account took in the meantime `409`, each with the message in [Troubleshooting](#troubleshooting).

### Withdraw the change

[`POST /auth/me/email/cancel`](/docs/api/reference/client/account-settings/#op-post-api-v1-auth-me-email-cancel) withdraws the change that is waiting, and answers how many it withdrew, such as `{"cancelled": 1}`.

## API

- `GET /api/v1/auth/me/email`: The sign-in address, and the new one waiting to be confirmed, if any (https://www.coritan.com/docs/api/reference/client/account-settings/#op-get-api-v1-auth-me-email)
- `POST /api/v1/auth/me/email`: Ask to sign in with another address (https://www.coritan.com/docs/api/reference/client/account-settings/#op-post-api-v1-auth-me-email)
- `POST /api/v1/auth/me/email/confirm`: Switch to the new address, from the link we emailed to it (https://www.coritan.com/docs/api/reference/client/account-settings/#op-post-api-v1-auth-me-email-confirm)
- `POST /api/v1/auth/me/email/cancel`: Withdraw the address change waiting to be confirmed (https://www.coritan.com/docs/api/reference/client/account-settings/#op-post-api-v1-auth-me-email-cancel)