Email login codes now come from our identity provider

Email login codes are now issued and verified by our self-hosted identity provider rather than by the app's own code. Same six-digit code, same inbox — but sign-in is enforced in one place instead of two, which is a tighter security boundary and what lets us require the same second step on other applications connected to your account, starting with the new feedback portal.

While we were in there, the sign-in screen learned to match how your account is actually set up. A passkey account leads with the passkey prompt, an authenticator account gets the code field, and either way you can tap "Email me a code instead" when your phone or security key isn't to hand — a code is only sent when you ask for one. Cancelling a passkey prompt now returns you to your other options instead of dropping you back to the password screen, and if you've lost access to everything, the support address is on the screen itself.

You can add or change a passkey or authenticator app under Settings → Profile & Security.