Account Security

Where your security settings live

Open Profile from the portal — from your name in the top-right corner, or the Settings entry in the sidebar. The left-hand rail of the profile page groups the pages, and under Security you will find:

• Password — change the password you sign in with.
• Sessions — see and end the devices signed into your account.
• SSH Keys — public keys installed on your servers when their operating system is reinstalled.
• API Keys — credentials for scripts and tools. This page appears only when your provider has enabled the customer API.

Two-factor authentication is not a page here: it is switched on for the whole platform by your provider, and you are taken through it at sign-in. That is covered below.

Change your password

1. Open Profile → Password.
2. Type your Current Password. An eye icon at the end of the field reveals what you have typed, so you can check it before submitting.
3. Type the New Password. It must be at least 8 characters and contain an uppercase letter, a lowercase letter and a number. If it does not, the field says so before you submit. This field has an eye icon too.
4. Repeat it in Confirm New Password. A mismatch is reported as “Passwords do not match”.
5. Click Update Password.

Warning: Changing your password signs you out everywhere, including the browser you are using. The confirmation reads “Password updated successfully. Please log in again.” That is deliberate: if someone else had your old password, the change ends their session too. Sign back in with the new password.

If you have forgotten your password, do not use this page — sign out and use Forgot password on the sign-in form. A reset link is emailed to the address on your account, and the link expires, so request a fresh one if it has been sitting in your inbox.

Two-factor authentication

Two-factor authentication adds a second step after your password. Whether it is available, and whether it is compulsory, is decided by your provider for the whole platform. Two kinds of second factor exist:

• An authenticator app — a six-digit code that changes every 30 seconds, produced by an authenticator app or by a password manager that supports one-time codes.
• An emailed code — a six-digit code sent to the address on your account each time you sign in. Your provider sets how long the code stays valid, how many attempts you get and how soon you may ask for another.

Enrolling

When your provider requires two-factor and your account has no second factor yet, enrolment happens the next time you sign in, before you reach the portal:

1. After your password is accepted, a screen headed Set up two-factor authentication appears with a scannable code. Scan it with your authenticator app, or use the Add to my password app link. If scanning is not possible, type in the key shown under Or enter this key manually.
2. Enter the six digits your app now shows. The field submits on its own once six digits are in.
3. A screen headed Save your recovery codes lists your one-time recovery codes with a Copy codes button. Save them now — they are shown once and cannot be retrieved later, and each one works only once.
4. Click I saved them — continue to finish signing in.

Tip: Store the recovery codes somewhere that is not the phone holding the authenticator app — a password manager, or printed and filed. They are what gets you back in when the phone is lost.

Signing in afterwards

After your password, one field asks for the code. It is a single field rather than six boxes, so browsers and password managers can fill the code for you.

• Using an authenticator, type the current six digits. If you cannot reach the app, click Use a recovery code instead and enter one of your saved codes. That code is then spent.
• Using an emailed code, check your inbox. If nothing arrives, use Resend code — it is disabled for a short cooldown and shows the seconds remaining. Too many wrong attempts stops the challenge; start the sign-in again.
• The Back to login link returns you to the sign-in form without completing the challenge.

If you lose your second factor

Recovery codes are the first answer. If you have lost both the authenticator and the codes, contact your provider and ask them to reset your two-factor. They will confirm who you are through a channel other than your email before doing so, which is a protection for you. After a reset you sign in with your password alone until you enrol again, and every recovery code you were holding stops working. See Getting Support.

Other sign-in options

Your provider may also offer sign-in through an external account. Where that is enabled, the buttons appear on the sign-in form itself; where it is not, only the email and password form is shown. Two-factor still applies to those sign-ins when your provider requires it.

Active sessions

Open Profile → Sessions for a list of everywhere your account is signed in. Each row shows:

• the device and browser the session belongs to;
• the address it was signed in from;
• how long ago it started;
• a Current badge on the session you are using, highlighted in blue.

Every other session has a Revoke link that signs that device out. When more than one session exists, a Revoke All Others button appears at the top of the page and ends all of them at once, leaving you signed in where you are. A revoked session stops working on its next request, so a signed-in browser is thrown back to the sign-in form the moment it does anything.

Tip: If you see a session you do not recognise, revoke it, then change your password — the password change ends every session, including any you might have missed.

SSH keys

Open Profile → SSH Keys. Public keys added here are installed on your dedicated servers when their operating system is reinstalled, so you can log in over SSH without a password.

1. Give the key a Name that tells you which machine it belongs to, for example My laptop.
2. Paste the contents of your public key file into the second field.
3. Click Add Key.

Removing a key asks you to confirm and warns that the key will no longer be installed on future reinstalls. Removing it does not remove it from servers that are already running — do that on the machine itself.

Warning: Only ever paste the public half of the key pair — the file ending in .pub. Never paste your private key anywhere, in this portal or outside it.

API keys

Open Profile → API Keys. The page exists only when your provider has enabled the customer API. Keys let scripts and tools act on your account, with your permissions, limited by the scopes you grant.

The header shows how many active keys you hold out of the maximum allowed and the hourly request limit per key. To create one, click New key and fill in:

New API key fields

Field	What it does
Label	A name so you can tell your keys apart later, for example the tool that uses it.
Scopes	What the key may do. read lists and reads your services, servers, invoices, orders and balance; services allows power, reinstall, password reset, backups, snapshots and keys on services you own; orders allows placing orders, buying add-ons and requesting upgrades; billing allows paying invoices and proformas from your credit balance and renewing early; destructive allows cancelling a service or an add-on. Scopes cannot be changed afterwards — create a new key to grant different access.
Allowed IPs	Optional. Addresses or ranges the key may be used from, comma- or newline-separated. Leave empty to allow any source.
Expires on	Optional. After this date the key stops working and is shown as expired.
Requests per hour	Optional. A lower ceiling than the account default, for a key that should never be busy.

Choosing the destructive scope shows a warning advising you to restrict the key to known addresses and give it an expiry.

The secret is displayed once, immediately after creation, under Your new API key. Copy it then; it cannot be recovered afterwards, and a lost key must be revoked and replaced.

Each key in the list shows its label, scopes, expiry, when it was last used and when it was created. From the row you can edit its label and expiry, open Recent requests to see the calls it made with their method, endpoint, status and time, and Revoke it. Revoking is immediate and cannot be undone — requests using that key are rejected from that moment.

The page also shows the base address to call and a reference for the available operations. For the full reference see Customer REST API.

Tip: Give each tool its own key with only the scopes it needs. Then revoking one tool’s access never disturbs the others, and the Last used column tells you which keys are dead weight.

A short checklist

• Use a password you use nowhere else, and keep it in a password manager.
• Enrol an authenticator app as soon as your provider offers it, and store the recovery codes away from your phone.
• Review Sessions occasionally and revoke anything you do not recognise.
• Keep API keys narrow, dated and labelled; revoke the ones you no longer use.
• Give colleagues their own logins through Team Members rather than sharing yours — that way each person’s access can be removed on its own.

Common problems

Symptoms and causes

Symptom	What to check
The new password is rejected	It is shorter than 8 characters, or it lacks an uppercase letter, a lowercase letter or a number.
You were signed out of everything unexpectedly	Someone with access to the account changed the password, or a session revoke was used. Both end sessions immediately.
The emailed code never arrives	Check spam, then use the resend link once the cooldown ends. If it still does not arrive, open a ticket — the address on your account may be wrong.
The authenticator code is always refused	The clock on the phone has drifted. Enable automatic time on the device and try again, or use a recovery code.
There is no API Keys page	Your provider has not enabled the customer API on this installation.
An API key returns a refusal	The key is expired or revoked, the call needs a scope the key does not hold, the request came from an address outside its allow-list, or the hourly limit is spent. The Recent requests list on the key shows which.
An added SSH key is not on your server	Keys are installed when the operating system is reinstalled, not retroactively. Add the key, then reinstall, or add it on the running machine yourself.

Related

Client Portal Overview, Team Members, Account Credit, Managing Your Services, Getting Support, Customer REST API.