Skip to main content

​
Secure operator access

Every authenticated user owns their personal Profile and Password & 2FA settings. Account configuration is more restricted, but account security is available to operator admins, permitted staff, agents, affiliates, and platform users for their own sign-in.

​
Update the password

  1. Open the user menu and choose Settings.
  2. Select Password & 2FA.
  3. Enter the current password.
  4. Enter and confirm a long, unique new password that satisfies the form rules.
  5. Save the change and confirm the success message.
Use a password manager. Do not reuse the router password, email password, provider dashboard password, or an API key. If the current password is rejected, use password recovery rather than repeatedly guessing. A user already signed in through an impersonation or support workflow should return to their own account before changing credentials.

​
Enable two-factor authentication

1

Start setup

In Password & 2FA, choose to enable two-factor authentication. The setup dialog presents an authenticator secret or QR code.
2

Enroll an authenticator

Scan the QR code with a trusted TOTP authenticator. Do not photograph it, paste it into chat, or send it in a ticket.
3

Verify the code

Enter the current authenticator code to complete setup. If a code fails, confirm the device clock is set automatically and try the next generated code once.
4

Store recovery codes

Save the recovery codes outside the device that holds the authenticator. A password manager or controlled offline record is appropriate. Each code should be treated like a password.
Regenerating recovery codes invalidates the old set. Replace every stored copy immediately after regeneration.

​
Add a passkey

The security page can register a passkey backed by Face ID, Touch ID, Windows Hello, Android screen lock, or a hardware security key, depending on browser/device support.
  1. Choose Add passkey.
  2. Follow the browser or operating-system prompt.
  3. Give the credential a recognizable device context if prompted.
  4. Test sign-in before relying on it as the only convenient authentication method.
A passkey does not remove the need to retain controlled recovery access. Browser private mode, remote desktops, and older devices may not expose the required authenticator.

​
Recovery and lockout

​
Lost authenticator but recovery codes available

Use one recovery code at the two-factor challenge, sign in, remove the lost authenticator, enroll a new one, and regenerate recovery codes.

​
Lost authenticator and no recovery codes

Use the formal account-recovery/support route. Be prepared to verify ownership. Support personnel should not ask you to disclose a password, API key, router secret, or payment-provider secret.

​
Password-reset email does not arrive

Confirm the address, check spam/quarantine, and avoid repeated rapid submissions. Record the timestamp and error if escalation is needed.

​
Staff and shared access

Never share the owner account. Create a separate staff identity and grant only the permissions needed for the role. When a staff member leaves, remove or disable their access and review API tokens, webhooks, payment credentials, and router access they managed. See Staff and permissions and Settings.