> ## Documentation Index
> Fetch the complete documentation index at: https://docs.centipidbilling.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account security

> Protect operator access with passwords, two-factor authentication, recovery codes, and passkeys.

# Secure operator access

Every authenticated user owns their personal **Profile** and **Password & 2FA** settings. Account configuration is more restricted, but account security is available to operator admins, permitted staff, agents, affiliates, and platform users for their own sign-in.

## Update the password

1. Open the user menu and choose **Settings**.
2. Select **Password & 2FA**.
3. Enter the current password.
4. Enter and confirm a long, unique new password that satisfies the form rules.
5. Save the change and confirm the success message.

Use a password manager. Do not reuse the router password, email password, provider dashboard password, or an API key.

If the current password is rejected, use password recovery rather than repeatedly guessing. A user already signed in through an impersonation or support workflow should return to their own account before changing credentials.

## Enable two-factor authentication

<Steps>
  <Step title="Start setup">
    In **Password & 2FA**, choose to enable two-factor authentication. The setup dialog presents an authenticator secret or QR code.
  </Step>

  <Step title="Enroll an authenticator">
    Scan the QR code with a trusted TOTP authenticator. Do not photograph it, paste it into chat, or send it in a ticket.
  </Step>

  <Step title="Verify the code">
    Enter the current authenticator code to complete setup. If a code fails, confirm the device clock is set automatically and try the next generated code once.
  </Step>

  <Step title="Store recovery codes">
    Save the recovery codes outside the device that holds the authenticator. A password manager or controlled offline record is appropriate. Each code should be treated like a password.
  </Step>
</Steps>

<Warning>
  Regenerating recovery codes invalidates the old set. Replace every stored copy immediately after regeneration.
</Warning>

## Add a passkey

The security page can register a passkey backed by Face ID, Touch ID, Windows Hello, Android screen lock, or a hardware security key, depending on browser/device support.

1. Choose **Add passkey**.
2. Follow the browser or operating-system prompt.
3. Give the credential a recognizable device context if prompted.
4. Test sign-in before relying on it as the only convenient authentication method.

A passkey does not remove the need to retain controlled recovery access. Browser private mode, remote desktops, and older devices may not expose the required authenticator.

## Recovery and lockout

### Lost authenticator but recovery codes available

Use one recovery code at the two-factor challenge, sign in, remove the lost authenticator, enroll a new one, and regenerate recovery codes.

### Lost authenticator and no recovery codes

Use the formal account-recovery/support route. Be prepared to verify ownership. Support personnel should not ask you to disclose a password, API key, router secret, or payment-provider secret.

### Password-reset email does not arrive

Confirm the address, check spam/quarantine, and avoid repeated rapid submissions. Record the timestamp and error if escalation is needed.

## Staff and shared access

Never share the owner account. Create a separate staff identity and grant only the permissions needed for the role. When a staff member leaves, remove or disable their access and review API tokens, webhooks, payment credentials, and router access they managed.

See [Staff and permissions](/subscribers/staff-and-permissions) and [Settings](/getting-started/settings).