Sign in and recover access
Use the sign-in page for the environment where you created your account. The available methods can differ between environments; a test-environment account does not give you access to another environment.
Sign in with an email link
When Send sign-in link is available:
- Enter your email in Email for sign-in link, then select Send sign-in link.
- Check your inbox and spam folder. Open the link only if you requested it; do not share it.
- On Complete email sign-in, enter the same email address that received the link, then select Complete sign-in. This confirmation is required even in the same browser, and also works when you open the link on another device.
- After sign-in succeeds, you are taken to your dashboard.
An invalid, expired, or already-used link cannot sign you in. Select Back to sign in and request a new one. If the email does not match, use the address that received the link. If email-link sign-in is not available at that address, return to sign in and choose an available method.
Reset a forgotten password
When the password form is available:
- Enter your account email in Email on the sign-in page. You do not need to enter your old password.
- Select Forgot password? below the password field.
- If the account can use password reset, follow the email instructions to choose a new password. Check your spam folder if needed.
- Return to sign in with your email and new password.
The confirmation does not disclose whether an email has an account. For a Google account, you can continue using Sign in with Google when that option is available. A password-reset email is different from a sign-in link.
If a network error appears, check your connection and try again. If you see Too many attempts, wait a few minutes before retrying. If a method is unavailable, try another displayed method or contact support.
Access your settings
Open the Settings page from the sidebar or by clicking your profile avatar and selecting Settings. In Chat, you can also use Settings (the gear) in the top action row.
Appearance
Choose how Upstream looks on your screen:
- Light — A bright interface with light backgrounds.
- Dark — A darker interface that reduces eye strain in low-light environments.
- System — Automatically matches your operating system's theme setting.
To change your theme, go to Settings > Appearance and select your preferred option. The change applies immediately in this browser. Select Save Settings to save that choice to your account for other devices.
This preference applies to the application. The public TurnkeyGTM website, including the blog, resources, and support pages, stays in light mode. Visiting those pages does not change your saved application theme; it returns when you navigate back to the app.
Email notifications
Control which emails you receive from Upstream. Go to Settings > Notifications to toggle these categories:
- Activation tips — Helpful guidance to get more out of Upstream as you get started.
- Weekly summary — A digest of your team's knowledge activity, including new entities, documents processed, and highlights.
- Product updates — Announcements about new features, improvements, and changes.
- Team activity — Notifications when teammates upload documents, approve entities, or make other changes.
Summary frequency
For the weekly summary, choose how often you receive it:
- Daily — Get a summary every day.
- Weekly — Get a summary once a week.
- Never — Turn off summary emails entirely.
New chat defaults
Choose a model and thinking budget under Settings > New chat defaults, then select Save Settings. These are your personal defaults for new Chat conversations. They do not change saved conversations, other users' defaults, or the embedded chat in Knowledge, Canvas or Sprint Planner.
Applying these defaults to conversations requires an updated chat backend. Until then, the conversation menu explains why its controls are unavailable, and chats use Gemini 3.5 Flash with the default thinking budget. Saving account defaults does not mean they have been saved on a conversation.
To change one saved conversation, open that chat's Conversation menu (three dots). Its model and thinking budget save with the conversation, including across reloads. Default thinking budget leaves the budget to the existing AI service behavior; the control enables custom budgets only for supported models. This surface does not manage providers or API keys.
If settings cannot load, account controls and saving are disabled to avoid overwriting saved preferences. Reload to try again. Chat reports a failed defaults read and uses the standard defaults for new chats; saved conversations keep their own choices.
Save account preferences
Save Settings is at the top right of the Settings page, including on mobile. It saves your account theme, email notifications and summary frequency, new chat defaults, and the Entity Proposals preference.
Unsaved changes appears when those values differ from the loaded or last successfully saved values. Returning every value to that baseline clears the indicator. Save is disabled when there are no changes or while a save is in progress. The page shows Saving settings…, then Settings saved after the account save succeeds.
If saving fails, the page shows an error and keeps your edits and the unsaved indicator. Try Save Settings again. Unsaved account edits are not a durable draft: leaving or reloading can discard them. Applying a theme immediately in your browser is separate from saving it to your account.
Organization source types use their own Add, Save, Archive, Restore, and ordering controls. Their changes are not included in the top-right Save or its unsaved indicator. Conversation settings in Chat also save independently.
Desktop MCP developer setup
The developer setup shipped in PR #756. It is not a generally available, self-serve MCP service.
Settings → Desktop MCP — developer setup provides a secret-free configuration for the current workspace and API. This developer workflow requires an authorized checkout and a desktop client supporting local stdio; there is no published package or hosted remote-phone MCP endpoint.
Build the server following the displayed instructions, replace the absolute server path, and supply an existing valid Firebase ID token privately through the desktop process environment as API_TOKEN. The token must belong to a workspace member and expires; this static-token mode does not renew it. Do not use a Firebase custom token or service-account key. Settings never displays or exports your browser token.
An authorized Linux operator can instead configure the separate local-session workflow described in the private checkout's services/mcp-server/README.md. It uses the existing account's normal Google or email/password sign-in and renews credentials from a protected local session file. Settings does not enroll that session or issue an API key. Do not provide both authentication modes, copy the session file into a client configuration, or paste credentials into chat. If you do not have an approved credential workflow, stop before connecting; self-serve credentials remain unfinished.
For retained-source access only, the operator can set MCP_SOURCE_READ_ONLY=1: the server advertises and accepts only read_document, rejecting other tools before authentication or HTTP. The permitted read can still renew and update local session custody. This is a local tool restriction, not an independently scoped or revocable account credential.
In full mode, screen_document optionally triages an authorized source for a question when the backend explicitly enables Jev for the workspace. Discover IDs with list_workspace_records or search_documents with metadata_only: true, screen, then read_document for evidence. Screening returns no source body and is advisory, not a citation. Partial coverage cannot justify whole-source rejection; if unavailable, read the source rather than automatically retrying. See Chat source screening and Jev request totals.
Check workspace API access makes a read-only request using your signed-in browser session. Success verifies membership and revision-safe artifact capability; it does not mean your desktop MCP client is connected or providers are available. Failure asks you to check sign-in, membership and API availability without changing data.
MCP knowledge proposals remain pending and draft artifact edits require the latest revision. Uploading still runs provider-backed source indexing, extraction and tagging, even though its knowledge proposals remain pending. Search and knowledge changes may also incur provider cost. Permission to connect is not permission to spend, import, approve or publish. A failed write can have partially succeeded: reconcile existing records before retrying. An upload capability error means no upload was sent. After an upload/import request fails, read back the exact document/job or imported issues in the app; do not automatically retry. Remote phone setup remains unavailable through this stdio-only surface.
create_knowledge can link a retained source through source_document_id; the link is stored in metadata, not the by-document index. list_workspace_records reads a bounded first page of documents, pending knowledge or draft artifacts. It is a recovery aid, not an exhaustive inventory; a missing record does not mean a write failed.
Exact-ID deletion is destructive and needs separate permission for that record. delete_knowledge requires the organization owner; delete_artifact uses workspace membership. Both soft-delete, and their corresponding MCP read tools return 404 afterward. Deleting an artifact does not undo knowledge extracted from earlier publication. There is no bulk-delete tool or deletion revision check. If the acknowledgement is lost, read the exact ID before deciding what to do; never automatically repeat the delete.
Preferences sync across devices
Successfully saved account preferences are tied to your account. Sign in on another device to load them. Unsaved changes on this page are not synced, and an already-open Settings page does not refresh its values live from another device.
Related articles
Still need help?
Email us at hello@getupstream.ai — we read every message.