Account Settings

Your own sign-in and profile. Change your password, turn on two-factor authentication, replace your API key or delete your account.

What Account Settings covers

Account Settings holds what belongs to you rather than to a project. That is your name and picture, how you sign in, and your API key. It opens from My account in your profile menu, and it looks the same whichever project you have open.

Your password proves it is you. Two-factor authentication, when your server offers it, adds a code from an app on your phone. Your API key lets scripts and tools act as you, so treat it like a password.

What your projects let you see and do is not set here. An admin gives you access in Users & Groups.

Use Cases

Change your password

Replace the password you sign in with.

1. Open My account from your profile menu.
2. Under Password, click Change password.
3. Enter your Current password.
4. Enter a New password. The form lists the rules it must meet as you type, and it must be different from your current one.
5. Enter it again under Confirm password, then click Change password.

Changing your own password signs you out on your other devices and browsers, and revokes the tokens you own, such as the ones in Token Manager. The browser you changed it in stays signed in. If you think someone else is signed in as you, changing your password ends their session too.

Turn on two-factor authentication

Make signing in need a code from your phone as well as your password.

You need an authenticator app on your phone. The Two-factor authentication section appears only when your server offers it.

1. Open My account from your profile menu.
2. Under Two-factor authentication, click Enable.
3. Scan the QR code with your authenticator app. If you cannot scan it, copy the key shown with it and enter that in the app instead.
4. Enter the 6-digit code the app shows, and click Confirm.
5. Save your recovery codes with Download or Copy all. Keep them somewhere other than your phone, because they are how you sign in without the app. This is the only time they are shown.
6. Click I have saved these codes.

From then on, signing in asks for a code from the app. If you lose access to your authenticator app, click Use a recovery code instead and enter one of your saved codes. Each code works once.

When fewer than three recovery codes are left, the section warns you. Click Generate new recovery codes and enter a current code from the app. Your old codes stop working, and the new ones are shown once.

Replace your API key

Stop an API key that may have leaked from working, and get a new one.

1. Open My account from your profile menu.
2. Next to API key, click Regenerate. A new key fills the field, and a bar at the bottom of the page shows you have unsaved changes.
3. Click Save changes. Until you do, your old key still works, and Discard puts it back.

Once you save, anything that still sends the old key is refused. Give each script or tool that used it the new key, or better, a token of its own from Token Manager in your profile menu, which you can limit and revoke without touching your key.

Replacing your API key does not affect your apps, which keep sending data as before.

Delete your account

Remove your own account when you no longer need access.

1. Open My account from your profile menu.
2. Under Danger zone, click Delete account.
3. Enter your password, and click Delete my account.

The account is deleted at once, you are signed out everywhere, and you land on the sign-in page. It cannot be undone. To come back later, an admin can add you as a new user in Users & Groups.

The last global admin on a server cannot delete their own account, so there is always someone who can manage it. Make someone else a global admin in Users & Groups first.

FAQs

How do I change my email address?

Ask an admin. Email addresses are changed in Users & Groups, not on Account Settings.

Why is there no two-factor authentication section on my page?

Two-factor authentication is not turned on for your server. Ask an administrator if you want to use it.

Why can't I turn off two-factor authentication?

Your administrator requires it, and the section says so. Only an administrator can lift that requirement.

I lost my phone. How do I sign in?

On the code screen, click Use a recovery code instead and enter one of the recovery codes you saved. Then click Disable under Two-factor authentication, confirm with another recovery code, and turn it on again with your new phone. If your administrator requires two-factor authentication, you cannot turn it off yourself, so ask an administrator for help.

Will regenerating my API key break my apps?

No. Regenerating your key does not affect your apps, which keep sending data as before. Only scripts and tools that call the API with your key stop working, until you give them the new key.

Does changing my password sign me out on other devices?

Yes. Every other device and browser is signed out, and the tokens you own are revoked, so a script that uses one needs a new token. The browser you changed it in stays signed in.

Why can't I delete my account?

You are the last global admin on the server. Make someone else a global admin in Users & Groups first.

Related Resources