Sign in when you connect
In webchat, open Account options, enter your X account name and password, and connect over TLS. The client requests SASL PLAIN only when the server advertises it, and waits for the server to confirm authentication.
For an IRC client that supports SASL, choose PLAIN and use your account name as the authentication identity. A client certificate can use SASL EXTERNAL if it is registered with X, but this browser client does not present an IRC client certificate.
Sign in after connecting
You can also send AUTH privately to X from a TLS connection. Use your account name even if your current nickname differs. Confirm the account with WHOAMI.
Your account’s channel permissions apply after successful authentication. Channel restrictions still apply. By default, RustNet allows two concurrent sessions per account; account-specific policies may differ.
/msg X AUTH <account> <password>/msg X WHOAMIAccounts with two-factor authentication
TOTP is optional and remains off until you complete enrollment. An enrolled account requires a fresh authenticator code or an unused recovery code.
With AUTH, supply the code as the third argument. With SASL PLAIN, append a colon and the code to the password. Webchat offers a separate code field and assembles this in memory. EXTERNAL alone cannot satisfy an enrolled account’s second factor.
/msg X AUTH <account> <password> <code>/msg X TOTP STATUSSet up TOTP
Use a TLS connection and send TOTP SETUP with your password. X replies with a private key for a SHA1, six-digit, 30-second authenticator. Add it to your authenticator and confirm within ten minutes.
Confirmation enables TOTP, signs out all account sessions, and issues eight single-use recovery codes. Save them privately, then authenticate with a fresh code. TOTP CODES replaces old recovery codes; TOTP OFF needs your password and a fresh authenticator or unused recovery code.
/msg X TOTP SETUP <password>/msg X TOTP CONFIRM <code>Cloaking and signing out
CLOAK ON uses your staff-assigned identity if one exists, otherwise user/<account>. CLOAK OFF restores the saved visible identity when available. Wait for X’s confirmation.
LOGOUT signs out only this connection. If you keep a protected nickname, authenticate again before the protection period expires or choose another nickname. Webchat never retains your password to reconnect an authenticated session.
/msg X CLOAK ON/msg X CLOAK OFF/msg X LOGOUTIf sign-in fails
Check the account name, password, authenticator clock and session count. Account suspensions or account-specific IP and certificate policies can also refuse authentication. A certificate-only account needs a suitable desktop client.
Use FORGOTPASS with your verified email for recovery. The reply does not reveal whether the account and address match. The private recovery link lasts one hour and is single-use; requesting or opening it does not change your password. Completing the reset signs out existing sessions, while registered certificates remain. Admin and developer accounts require developer assistance.
/msg X FORGOTPASS <account> <registered-email>Examples use placeholders. Copying a command does not send it. Replace placeholders and review the destination before sending.