Account
The sign-in methods of a HotCodePush account, two-factor authentication and its recovery codes, sessions, API tokens, notification preferences and deletion.
A HotCodePush account signs in with an email address and password, GitHub, Google or an organization's single sign-on.
Settings › Account also holds the display name, the date and time format and the User ID for support mails.
Sign-in methods
Sign-up with an email address mails a verification link, valid 60 minutes. Opening it verifies the address and signs you in. Until then a password sign-in is refused and a new link is offered. A member of the organization that verified their address's domain signs in through its identity provider alone.
Under Identities on Settings › Account, GitHub or Google connects to an existing account with any address, and disconnects again. The CLI's hotcodepush login prints a one-time code you approve in the console, and its session is listed as HotCodePush CLI.
A password is 8 to 128 characters, with no other rule. Password on Settings › Account changes it with the current one. Forgot password on the sign-in page mails a reset link valid 60 minutes. A change ends every other session and the MCP sign-ins, a reset ends every session, and both send a mail.
An account created through GitHub, Google or SSO has no password. Password on Settings › Account sets a first one, which adds the email sign-in. The call is POST /v1/users/me/password. It answers password_already_set when one exists and sso_required for a member behind a verified SSO domain.
Two-factor authentication
Two-factor authentication is a time-based code from an authenticator app, 6 digits every 30 seconds. It needs the account password: enable it under Two-factor authentication on Settings › Account, where the app scans a QR code. A set of recovery codes then shows once, and each code works once.
A password sign-in then asks for the authenticator's code, or a recovery code in its place. Using a recovery code mails you the number left. Regenerate under Recovery codes replaces the whole set.
Enabling or disabling asks for the password, ends every other session and the MCP sign-ins, and sends a mail. Regenerating asks for the password and sends a mail. Disabling is refused with two_factor_required while an organization you belong to requires two-factor authentication and its plan includes it.
Sessions
A session lasts 30 days and is renewed at most once a day while in use. Settings › Sessions lists each session's client, such as Chrome on macOS, the address and country it signed in from, last seen and created. Last seen trails by up to 5 minutes.
The current session is marked Active. Delete one session, a selection or all of them. Delete all sessions signs you and the MCP clients out. A sign-in from a new client mails you its client, country and time, and the CLI's hotcodepush logout ends its own session.
API tokens
An API token is the bearer the API, the CLI, the Node and Python clients and the MCP server take in place of a session. It acts as you, with your role in each organization, and an endpoint above that role answers 403 forbidden.
Create tokens under Settings › Tokens with a name and an expiry:
- 30 days. This is the default.
- 90 days.
- 1 year.
- A date of your choice, from tomorrow on.
- No expiration.
The value shows once, and a mail confirms every new token. The list shows each token's name, expiry, last request, up to 5 minutes behind, and creation date.
Tokens are created and deleted in the console alone, from a session, never with a token. An account holds at most 100, as Limits and fair use says. Deleting your account deletes every token. Removal from an organization ends only its reach there.
The operations that change who may act in an organization or spend its money refuse a token with 403 forbidden. What a token cannot do lists them. Security has the practices for CI tokens.
Notification preferences
Settings › Notifications holds one row per category with an Email checkbox and an On HotCodePush checkbox, the console's bell. Everything is on by default, the newsletter included, and every mail of a category you can leave carries an unsubscribe link. Turning off an email marked always on answers notification_mandatory.
| Category | Carries | On HotCodePush | |
|---|---|---|---|
| Account and security | Covers a sign-in from a new client, password, two-factor and recovery-code changes, a new API token, invitations and every change to your memberships. | always on | optional |
| Billing | Covers the spending cap, paused updates and an ending Enterprise contract. | always on | optional |
| Service notices | always on | optional | |
| Team activity | Covers an accepted invitation, to the inviter, and a member joined through SSO, to Owners and Admins. | optional | optional |
| Onboarding and lifecycle | Covers a welcome mail at sign-up and a nudge when a first release reaches no device. | optional | optional |
| Newsletter and product updates | Covers the newsletter. | optional | not offered |
| Product alerts, per organization | Covers paused and revoked releases, failure rates, storage and fair-use warnings and disabled webhooks. | optional | optional |
| Spending alerts, per organization | Covers the cap warning and the cap reached. | optional | optional |
The two per-organization categories are set under Subscriptions on the organization's settings page. The API is GET and PATCH /v1/notification-preferences, with ?organizationId= for an organization's rows, from a session.
Deleting the account
Delete account under Danger zone on Settings › Account asks for your password, and an account without one sets a password first. The call is DELETE /v1/users/me with the password, from a session. It is refused with sole_owner while you own an organization that has other members: transfer the ownership or delete the organization first.
An organization where you are the only member is deleted with the account. At once, the account can no longer sign in, its sessions, API tokens and MCP sign-ins are deleted, and it leaves every member list. After 7 days the account is hard-deleted. Until then, support can restore it, and a mail names the date.
Last updated on
Slack
Create a Slack incoming webhook and a HotCodePush webhook in Slack format, and every release, pause and rollback you subscribe to posts to the channel.
Analytics
What the analytics page of a HotCodePush app shows per channel and period, where every figure comes from, and how to read the same numbers from the CLI and the API.