"Invalid email or password"
Check for typing mistakes first, or use Forgot password to reset it. Ten failed sign-ins from the same network lock sign-in from that network for 15 minutes, and the portal shows the same message as for a wrong password. Fifty failures from anywhere lock the account itself for 15 minutes. Wait, or reset your password if you think someone is guessing it. The account owner is emailed when a lock is applied.
Lost your second factor
Use another method (authenticator code, passkey or push), or one of your 10 recovery codes. Then remove the lost device and add a new one.
A sign-in you did not start
Never approve it. In the app tap This wasn't me, then change your password and use Sign out everywhere to end all sessions.
Sessions
Sessions end after 12 hours without activity, or 7 days at most. Sign out everywhere revokes them all.
Change your email address
Under Settings → Profile enter the new address and your password (plus your authenticator code when MFA is on). We send a confirmation link to the new address, valid for 1 hour, and a notice to your current address. The sign-in address changes only when the link is opened. Your other sessions are then signed out and the old address is told. Changing your password cancels a pending change.
Still stuck? Contact us from a device where you can still receive email.