Your account

The account is the person; a store is something that person owns. This page is about the person: open avatar menu → Account (vi: menu ảnh đại diện → Tài khoản) from any screen.

Three things surprise people, so they go first:

• Changing your email sends the code to the NEW address, not the current one.
• You cannot disconnect the last way in. To remove Google, set a password first.
• An account created with Google or GitHub has no password at all — not an empty one, none. The sign-in screen says so instead of calling it wrong.

Profile

Picture

Upload takes JPEG, PNG, WebP or GIF, up to 2 MB. Anything larger is refused on the spot rather than after the upload has been spent.

The format is decided by the file's contents, never its extension, so renaming invoice.pdf to photo.png does not get past it. SVG is not on the list, deliberately: it is a document browsers execute, and this picture renders inside your own admin screens.

Remove takes away a picture you uploaded. If the account was created with Google or GitHub, it falls back to that provider's picture rather than to nothing — you are undoing an upload, not declaring that you want no picture.

Display name

Edit it in place and press Save. The button only wakes up once you have actually changed something.

The limit is 80 characters, not bytes, so a Vietnamese name with diacritics is not charged double.

Email address

Moving to a new address takes two steps, and the first one may be the opposite of what you expect:

1. Press Change, type the new address, press Send code. A six-digit code goes to the new address.
2. Enter it and press Confirm new address.

The code goes to the new address because the thing that needs proving is that you can open the mailbox you are moving to. The current address needs no proving — you are signed in with it.

That code is bound to the address it was sent to: one requested for a@example.com will not confirm a move to b@example.com, even while it is still valid.

When the move lands, every other device is signed out. The session you are using is not: an email address is half of a credential, and a session opened before it moved should not outlive the move.

Sign-in

Password

Changing a password needs all three: the current password, the new one, and a code emailed to you. The code is only sent once both password fields are filled, so nobody triggers an email by opening this dialog.

If the account has no password — you signed up with Google or GitHub — this becomes Set a password and asks for no current one, because there is none. It still asks for the emailed code: that proves you can open the address, which is the only thing such an account has ever had.

Connected accounts

Every provider this platform has configured gets a row, with the email address of that account at the provider — which is the useful part when you have two Google accounts.

Connect sends you to the provider's consent screen and returns you to the screen you were on.

Disconnect is disabled when it would be the last way in, and the reason is printed under the button rather than hidden in a tooltip. An account nobody can get into leaves its owner resetting a password that never existed. Set a password first, then disconnect.

Two connected providers also count as two ways in — you can drop one of them without setting a password at all.

If the platform has no providers configured, the section says so. No dead button is drawn: one that leads only to an error is worse than none, because you press it and conclude your account is broken.

Signing up with Google or GitHub

On both Sign in and Create account the buttons sit above the password form. Somebody who already has a Google account is on the shorter path, and should not have to read past a form to find it.

Signing up this way skips the six-digit code: the provider has already verified the address, which is what that code exists to prove. See Create an account for the password route.

If the address at the provider matches an account you already have here, you land in that account rather than a second one — provided the provider has verified the address. An unverified one is refused: at some providers anybody can put another person's address on a fresh account.

The buttons appear only where the platform's operator has configured that provider's keys. No buttons means this platform has not turned it on, not that something is wrong with your account.