Account security
Your servers are only as safe as your account. Whoever takes over your account reaches your servers too — this page covers the tools the console gives you to keep that from happening.
Two-factor authentication (2FA)
Adds a second check so that a stolen password alone is not enough. Go to Account → Two-factor authentication → Set up 2FA.
Prepare an app
Install an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, Authy, 1Password — any of them works).
Scan the QR code
Scan the code shown in the console. If you cannot scan it, type the secret shown underneath into the app manually.
Confirm the code
Enter the 6-digit code from the app. Once verified, 2FA is enabled and is requested at every login.
Recovery codes
When you enable 2FA, 10 single-use recovery codes are generated and shown on that screen only.
Save these codes immediately
If you lose your phone, these codes are the only way back into your account. They are not shown again after you close the screen. Store them in your password manager or print them and keep them somewhere safe.
Each code works once. At login you can enter a recovery code instead of the 6-digit code. If you are running low, generate a new set from the console — generating new codes invalidates all the old ones.
Active sessions
Account → Active sessions lists every device signed in to your account: the last seen IP address, device information and last use. The device you are on is marked "This device".
If you see a session you do not recognise, end it immediately with Revoke. If you suspect anything, change your password as well: changing the password closes all sessions.
Why the IP may differ from what you expect
The list shows where the session was last seen. On a VPN you see the VPN exit address; on mobile data, your carrier's address.
Password
Your password must be at least 8 characters and contain upper case, lower case and a special character. If you forget it, reset it from the link on the login screen; the reset link is valid for one hour and works once.
We cannot see your password — it is stored irreversibly (argon2id). Nobody, including support, can read it.
Email and phone verification
The account page shows the verification status of your email and phone. Verified contact details matter for account recovery and for receiving important notifications.
API tokens
Tokens work independently of your password and can only manage resources. Account security settings (2FA, sessions), token management and billing operations are closed to the API — a leaked token cannot take over your account.
Use tokens carefully all the same; see API tokens.
What we do on our side
- Passwords are stored with argon2id; 2FA secrets are encrypted.
- Failed login attempts are counted and the account is temporarily locked past a threshold (against brute force).
- Every significant action (login, password change, enabling or disabling 2FA, creating a token, deleting a server) is written to an audit log with the IP address.
- The console session is delivered as an
httpOnlycookie; JavaScript on the page cannot read your session.