# Change email

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/change-email

Confirm a new address before it takes effect, tell the old one and keep it working until then.

Usually comes after: [Settings page](https://gradus.kazet.blog/tree/cloud-application/step/settings-page).

## Prompt for your AI assistant

```
Read the sign-in decision record in docs/decisions. Add changing the address to settings. On a hosted provider, use its own flow and update the local identity from its answer or webhook. For own passwords, ask for the password or a fresh sign-in, send a single-use short-lived link to the new address with the existing token mechanism, keep the old address active until the link is used and tell the old address straight away, with a way to report that it was not them. End the user's other sessions after the change. Never reveal that an address is taken: show the same message and write to that address instead. Test an expired link, a taken address and a change that is never finished.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt