# Profile and login security

URL: https://docs.spacerun.co/docs/platform/guides/profile-and-security

> Edit your profile, refresh authentication, and revoke login sessions and device authorizations.

Prerequisites: a signed-in user and [apiRequest](https://docs.spacerun.co/docs/platform/guides/quickstart). All operations here apply to the caller's own account.

## Read and update your profile

[getMyProfile](https://docs.spacerun.co/docs/platform/reference/profile/getMyProfile) returns the profile. [updateMyProfile](https://docs.spacerun.co/docs/platform/reference/profile/updateMyProfile) rejects unknown fields and requires at least one editable field:

```ts
const profile = await apiRequest("/v1/me", {
  method: "PATCH",
  body: JSON.stringify({ display_name: "Example Player", visibility: "private" }),
});
console.log(profile.display_name, profile.visibility);
```

Editable fields include username, names, bio, visibility, locale and timezone. Username has its own pattern/length requirements; visibility is `public`, `friends`, or `private`. Use the [avatar workflow](https://docs.spacerun.co/docs/platform/guides/uploads-and-media) rather than PATCHing an avatar storage path.

## Login sessions and devices

[listMyAuthSessions](https://docs.spacerun.co/docs/platform/reference/profile/listMyAuthSessions) lists authentication sessions. [revokeMyAuthSession](https://docs.spacerun.co/docs/platform/reference/profile/revokeMyAuthSession) returns 204 on deletion:

```ts
await apiRequest(`/v1/me/sessions/${encodeURIComponent(loginSessionId)}`, {
  method: "DELETE",
});
```

Use an ID from the login-session list, not a game-session ID. `GET /v1/me/sessions` manages login sessions; `POST /v1/me/sessions` starts a game. Stopping a game uses its dedicated [session lifecycle](https://docs.spacerun.co/docs/platform/guides/session-lifecycle) flow.

[listDeviceAuthorizations](https://docs.spacerun.co/docs/platform/reference/device-authorization/listDeviceAuthorizations) and [revokeDeviceAuthorization](https://docs.spacerun.co/docs/platform/reference/device-authorization/revokeDeviceAuthorization) manage device grants. A grant's pending/approved/claimed/consumed status is not a game lifecycle state.

## Refresh and recover

On an expired access token, use `supabase.auth.refreshSession()`, obtain the new `access_token`, and retry a read. If refreshing fails, sign in again. Avoid blindly replaying a write after a transport error; check the endpoint's idempotency behavior. A 204 has no JSON body. Revoking the current login session can require reauthentication.

## Account deletion limitation

[requestAccountDeletion](https://docs.spacerun.co/docs/platform/reference/account/requestAccountDeletion) currently stores a confirmation token and returns `expiresInSeconds` (900), but the implementation does not deliver the token to the user. [confirmAccountDeletion](https://docs.spacerun.co/docs/platform/reference/account/confirmAccountDeletion) expects that token and rejects invalid/expired tokens. There is no supported complete client walkthrough until token delivery is implemented. Do not assume an email was sent or attempt to read server-side Redis. This is a backend dependency, not an undocumented client parameter.