# Account security

> Sign-in methods, two-factor authentication, passkeys, sessions, and how to keep the identities and API keys on your account safe.

Source: https://0.0.0.0:3000/docs/privacy/account-security
Documentation index: https://0.0.0.0:3000/docs/llms.txt

Your account is protected at two layers. Your **identity**, how you sign in to the dashboard, controls who can create keys, add funds and administer organizations. Your **API keys** authenticate code. The two are independent: signing out or changing your password doesn't revoke API keys, and revoking a key doesn't sign anyone out.

Manage your identity in [Profile](/dashboard/profile). These settings belong to you as a person and apply to every account you can switch to. The dashboard's **Security** page is different: it holds the active account's [request policy](/docs/privacy/request-policy).

## Sign in

| Method | How it works |
| --- | --- |
| **Email and password** | Register with your email address, confirm it from the email, then choose a password |
| **Passkeys** | Your device's screen lock or a security key, once you've added one |
| **Connected logins** | Google, GitHub or Apple, when offered on the sign-in page |

Registering with email asks only for your address. Open the email and choose **Complete registration**, then choose a password. The link expires after ten minutes; if it expires, choose **Resend email** on the **Check your email** page. Connected logins don't need a separate confirmation: the provider supplies your email address.

Registration and password sign-in run a background security check. If asked, complete the checkbox shown above the button. If the check retries, sign-in or registration continues automatically when it succeeds. If you change a field, choose another sign-in method or let the checkbox time out first, choose **Sign in** or **Create account** again.

Your identity isn't tied to your email address. Changing your email doesn't change who you are, and an email match never grants access on its own.

If you lose every way to sign in, contact support; identity verification is required.

### Forgotten password

Choose **Forgot password?** on the sign-in page, enter your email address and choose **Send reset link**, then open the email and choose **Reset password**. If you've set up two-factor authentication, you complete it before choosing a new password. The response is the same whether or not an account exists for that address.

### Connected logins

**Connected logins**, in the **Sign-in** section of your profile, shows each available provider as **Connected** or **Not connected**.

- **Connect** links a provider to your identity. You prove you control the provider account during the flow.
- A matching email address never links accounts automatically. Signing in with a provider whose email matches your identity doesn't sign you in to it; connect the provider from your profile first.
- **Disconnect** removes a linked provider. You can't remove your last way to sign in.

## Two-factor authentication

Add an authenticator app as a second factor in **Two-factor authentication**:

:::steps

### Start setup

Choose **Set up authenticator**. Scan the QR code with your authenticator app, or type the key manually.

### Verify

Enter the current code from the app and choose **Verify authenticator**.

### Save your recovery codes

Store the one-time recovery codes somewhere other than the device running your authenticator, confirm you saved them, and choose **Finish setup**.
:::

Once it's on:

- Password sign-in and returning connected-login sign-in ask for a code from the app or an unused recovery code.
- Passkey sign-in doesn't ask for a code; the passkey is already a strong, device-bound factor.
- Each recovery code works once. **Recovery codes** shows how many are left; **Replace codes** issues a new set.
- **Replace authenticator** moves to a new device. **Turn off two-factor authentication**, in the authenticator's **⋯** menu, removes the authenticator and its recovery codes.

## Passkeys

In **Passkeys**, in the **Sign-in** section, choose **Add passkey**, enter a **Passkey name** you'll recognize, and follow your browser's prompt. You can add up to 20 passkeys. Each one's **⋯** menu holds **Rename** and **Remove passkey**.

A passkey works only on the site it was created for. Add one on each device you use, or use a synced passkey provider.

## Sessions

**Sessions** lists every browser and command-line session using your identity, with when it signed in and was last active. The current one is marked **This session**.

- **Sign out** ends one session; **Sign out others** ends every session except this one. To end this one, use **Sign out** in the sidebar.
- A signed-out session stops working within seconds.
- Inactive sessions expire. When your session ends, the dashboard asks you to sign in again and then returns you to the page you were opening.

Signing out sessions doesn't affect API keys or provider app keys. Revoke those separately.

## Changes that need confirmation

| Change | Confirmation |
| --- | --- |
| **Change email address** | A link goes to the **new** address. Your current address stays active until you open it; afterwards the old address is notified and your other sessions are signed out |
| **Change password** | Enter your **Current password**, **New password** and **Confirm new password**, then choose **Send confirmation email**. The password changes when you open the link sent to your current address, and your other sessions are signed out |
| Remove a passkey, disconnect a login, turn off two-factor authentication | You may be asked to sign in again |

Confirmation links expire after ten minutes. While a change is pending, your profile offers **Resend email** and **Cancel request**.

**Change password** appears only when your identity has a password; identities that sign in only with passkeys or connected logins don't have one.

## Delete your account

**Delete account**, in your profile, permanently erases your profile and closes your personal account. It first lists anything you must resolve:

- organizations where you're the only owner: make another member an owner first;
- a personal balance or provider earnings that isn't zero;
- pending funding, payment-method setup or withdrawals;
- requests still running;
- endpoints on your personal providers that still have models: delete those endpoints first.

Then sign in again, choose **Send deletion code**, enter the code from your email, type `DELETE` and choose **Permanently delete account**. Keys you created, in any account, are revoked. See [Data retention](/docs/privacy/data-retention#deleting-your-account) for what is erased and what is kept.

## Protect your API keys

API keys are bearer credentials: anyone who has one can spend from your balance until you disable it. Two-factor authentication doesn't protect them.

- **Store keys in a secret manager or environment variables.** Never commit them, paste them into tickets or put them in URLs.
- **Keep them server-side.** Browser requests from third-party origins are rejected with `403`, and anything shipped to a client can be extracted.
- **Limit the damage.** Use one key per application and environment, set a [spending limit](/docs/account/api-keys#spending-limits) on each, and give temporary keys an expiry.
- **Guard management keys closely.** A management key can create inference keys; keep it only in the service that provisions them.
- **Act fast on a leak.** Disable the key in [Keys](/dashboard/keys) or with the [management API](/docs/account/management-keys#disable-a-leaked-key), review its spend in Activity, then delete it.
- **Remember that keys follow their creator.** In an organization, a key stops working when the person who created it leaves or is removed.

## Checklist

- Turn on two-factor authentication and store the recovery codes offline.
- Add a passkey on each device you use.
- Review **Sessions** now and then and sign out anything you don't recognize.
- Give every application its own key with a spending limit.
- Keep management keys out of application servers.

## Next steps

:::cards

- {key} [API keys](/docs/account/api-keys) Create, limit and rotate keys.
- {key} [Management keys](/docs/account/management-keys) Automate key rotation and revocation.
- {building} [Organizations](/docs/account/organizations) Roles and what each can do.
- {database} [Data retention and logging](/docs/privacy/data-retention) What the platform stores about your requests.
  :::