# Accounts

GraceDNS works without an account. You can mint a configuration on the [start page](../start), point a device at it, and be protected in under a minute; no email, no password, no form. This page explains what an account adds and how the two fit together.

## Configurations without an account

An anonymous configuration is a full configuration: the same protection lists, custom rules, block types and defaults as any other, compiled to the resolvers the same way. Logging is off (`log_mode: none`) and stays off until you turn it on.

When you create one, you receive an **edit token** exactly once. It is the only key to that configuration: whoever holds it can view and change the rules, and we cannot show it again or recover it. Save it somewhere safe, like a password manager. If you lose the token, the configuration keeps resolving with its last saved rules forever; you just cannot edit it anymore, and the practical fix is to create a new one.

## What an account adds

Signing in creates your own tenant and keeps your configurations attached to it:

- **Saved configurations.** Your configurations live in your account and are listed in the dashboard; no token to look after, and they are never subject to the anonymous pool limits.
- **Access from anywhere.** Sign in on a new machine and everything is there.
- **Query log access, later.** Viewing query logs (when you enable logging) will be an account feature, since logs need an owner with controlled access.

Sign-in happens on our hosted account pages (passkey-first, no passwords to remember). The first sign-in provisions your account automatically; there is no separate registration step.

## Claiming an anonymous configuration

The upgrade path is one call: sign in, then claim the configuration with its edit token. Claiming moves it into your account and permanently invalidates the edit token; from then on, only your account can edit it. The configuration id stays the same, so devices already pointing at it never notice.

Questions: support@gracedns.eu.