Account

Manage passwords, two-factor authentication, recovery codes and API keys for MCP and automation tools.

Changing your password

Under Account → Account, enter the current password and a new password of 8-72 UTF-8 bytes.

Save the change, then use the new password at the next sign-in. Keep recovery details up to date before replacing an authenticator or phone.

Resetting your password

Open the recovery entry on the sign-in page:

1. Enter the account email address to request a 6-digit reset code.
2. Submit the reset code and a new password.

The reset code is valid for 30 minutes. The page shows the same result after every request; if no email arrives, first check that the address belongs to the account.

A successful reset invalidates every browser session, which must sign in again. Registered devices use separate device identities and are unaffected.

Two-factor authentication

Under Account → Account, enable TOTP two-factor authentication:

1. Start enrolment and scan the QR code with an authenticator app.
2. Enter the current 6-digit code.
3. Store the 10 recovery codes shown once on completion.

Each recovery code works once. Store them securely and separately from the authenticator device.

Disabling two-factor authentication

Disabling two-factor requires verification with the current authenticator within the last 5 minutes. The console requests fresh authentication when that window has expired.

Replacing recovery codes

Generate a new set from account security settings; the old codes become invalid without re-enrolling two-factor authentication. If neither the authenticator nor a recovery code is available, use the public channels on the contact page.

API keys

Under Account → Account → API keys, create separate credentials for MCP or automation tools. Choose a name, read-only or management permission, and Never expires or a lifetime of 30, 90, 180 or 365 days. Each account can have up to 10 active keys. Creating and revoking keys requires a recent password check, or verification with your current authenticator when two-factor is enabled. Support proxy access cannot view or manage keys.

The complete key is shown only once; later views show its last four characters. Store it in a trusted application's private configuration, never a conversation. The list shows permission, expiry, last use and revocation status. All active keys remain visible; older history may be truncated with a notice. Expired or revoked records are removed after 90 days. Active keys that never expire remain stored and count toward the active-key limit.

Revocation removes access on the next request. Password changes, account suspension or deletion, and disabling or changing the assigned brand also revoke active keys. Re-enabling the account or brand does not restore them. Expired records keep their original status. To rotate a key, create a replacement and update the tool configuration before revoking the old one. Keys work only on this site. See Agent MCP for permission boundaries and configuration examples.

After changing account security

The client does not store the account password. After changing account security settings:

• Password and two-factor changes do not interrupt devices already in a network.
• Blocking or deleting a device does not affect account sign-in.

If a device can no longer access the network and reports an authentication error, check the approval state, network and error code before taking further action.

Quick troubleshooting