Account security

Your account controls every license you issue, so it is worth a few minutes to lock it down.

Turn on two-factor authentication

1. Open Security → Two-factor in your dashboard.
2. Scan the QR code with an authenticator app (any TOTP app works), or type the setup key.
3. Enter the 6-digit code to confirm. You will be shown 10 recovery codes once — store them somewhere safe (a password manager is ideal).

From then on, signing in — with a password, Google or Discord — also asks for a code. Each code works once, and turning 2FA off asks for your password and a fresh code.

Sessions and history

• Security → Sessions lists every signed-in device with location and last activity, and lets you sign any of them out — or all others — in one click.
• Security → Sign-in history records every sign-in, failure and security change. We e-mail you when a password changes, 2FA is turned on or off, a recovery code is used, or someone signs in from a new device.
• Changing your password signs out every other session and forgets remembered devices.

Sensitive actions ask again

Creating an API token, changing your e-mail address, disconnecting a sign-in method and deleting your account all require your password again (and a fresh authenticator code if 2FA is on), even though you are signed in.

Passwords

Passwords must be at least 12 characters and are checked for how guessable they really are — common words, names, dates and keyboard patterns are rejected, and so is any password containing your e-mail name. Accounts that only use Google or Discord can add a password from Security.

API tokens

Give each integration its own token with the fewest permissions it needs, restrict it to your server’s IP addresses, set an expiry, and revoke it the moment you no longer need it. See the Automation API.

Found a security problem?

Please tell us privately through the contacts on our community page before sharing it publicly — we’ll respond as quickly as we can.