Account and security

Manage your profile, your password, your two-factor security, your keys and your signed-in devices.

Open Account Settings from the client area. A Back to Dashboard link at the top takes you back.

The area has six pages. On a wide screen they show as a side menu. On a narrow screen they show as a tab strip:

Page	Purpose
Profile	Name, username, email, avatar, and linked SSO accounts.
Security	Password, two-factor authentication, and security keys.
API Tokens	Personal tokens for the API.
SSH Keys	Public keys for SFTP.
Sessions	Your signed-in devices.
Privacy & Data	Data export and account deletion.

The API Tokens page appears only when your provider has turned the API on.

Profile

The top card shows your avatar, your name, your username, your email address, and the date that you joined. It also shows a badge that reads 2FA Enabled or 2FA Disabled.

Three cards under it show your counts of active sessions, API tokens, and SSH keys. Click a card to open that page.

If two-factor authentication is off, a banner offers an Enable 2FA link.

Profile picture

• Click Upload Photo to choose an image. The formats are JPG, PNG, and GIF. The limit is 2 MB.
• Click Remove and confirm to return to the default picture.

Profile information

Field	Description
First Name	Your given name.
Last Name	Your family name.
Username	Your display name across the panel.
Email Address	Your login address.

The card shows You have unsaved changes or All changes saved. Click Save Changes to apply.

Linked accounts

This card lists each SSO account that you linked to your profile. Each row shows the provider, the account name, the email address, the link date, and the last use.

To link an account, use the "Continue with" buttons on the login page.

To unlink an account, click the unlink icon on the row. Then click Confirm.

Security

Change your password

Enter your Current Password, then your New Password twice. The minimum length is 8 characters. A strength meter under the new password reads Weak, Medium, or Strong. Click Update Password.

Two-factor authentication

The panel uses an authenticator app for two-factor authentication. Google Authenticator, Authy, and 1Password all work.

To turn it on:

1. Click Enable 2FA.
2. Scan the QR code with your authenticator app. If you cannot scan it, click the eye icon to show the secret, then type the secret into the app.
3. Enter the 6-digit code from the app in the Verify Setup field.
4. Click Verify & Enable.
5. Save the recovery codes that the panel shows.

To turn it off, click Disable 2FA. The dialog asks for a code from your authenticator app and for your password.

WARNING

Without two-factor authentication, your password is the only protection on the account.

Recovery codes

The panel issues 10 recovery codes. Each code works one time. Use a code when you lose access to your authenticator app.

Click View Recovery Codes to open the list again. In that dialog you can:

• Click Copy All to copy every code.
• Click Download to save the codes as a text file.
• Click Regenerate to issue a new set. This action cancels every old code.

Security keys

A security key is a hardware key such as a YubiKey, or a built-in authenticator such as Touch ID or Windows Hello. A security key resists phishing.

To register one:

1. Click Register Security Key.
2. Enter a name, for example "YubiKey 5". The name is optional.
3. Click Continue.
4. Follow the prompt from your browser.

You can register more than one key. Each row shows the name, the date that you added it, and the last use. The pencil icon renames a key. The bin icon removes a key, after you click Confirm.

Signing in with two-factor authentication

At sign-in the panel asks for a code. Three links switch the method:

• Use a security key instead
• Use authenticator app instead
• Use a backup code instead

API tokens

A personal API token lets a script or an integration act as you.

To create one:

1. Click Create Token.
2. Enter a Token Name.
3. Choose an Expiration. The options are Never, 7 days, 30 days, 90 days, and 1 year.
4. Select the Permissions. Three links help you: Select All, Read Only, and Clear.
5. Click Create Token.

The permission groups are Full Access, Server, Files, Backups, Databases, and Schedules.

The panel shows the full token one time, under Your API Token. Copy it and store it safely. After you click Done, the panel shows only a masked form such as bp_exampleid_****.

To revoke a token, click the bin icon on its row and confirm. Anything that uses the token stops working at once.

If an administrator turns API access off, a banner explains it. Existing tokens keep working. You cannot create a new one.

SSH keys

An SSH key signs you in to SFTP without a password.

To add a key:

1. Click Add SSH Key.
2. Enter a Key Name, for example "My Laptop".
3. Paste your public key in the Public Key field. The file is usually ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub.
4. Click Add SSH Key.

The panel accepts ssh-rsa, ssh-ed25519, ssh-dss, the ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, and ecdsa-sha2-nistp521 types, and the sk- hardware-backed forms.

Each row shows the key name, the SHA256 fingerprint, the date that you added it, and the last use. Click the bin icon to delete a key. Anything that authenticates with that key then loses access.

WARNING

Paste the public key only. Never paste a private key.

Sessions

This page lists your signed-in devices in two groups, Current Session and Other Sessions.

Each entry shows a device icon, the device and browser, the location if the panel knows it, the IP address, and the last activity. Your current device carries a Current badge.

• Click the bin icon on another session, then click Revoke. That device signs out at once.
• Click Revoke All Others to sign out every other device. Your current device stays signed in.

If you suspect that somebody else used your account, revoke the other sessions and change your password.

Privacy and data

Export your data

Click Export My Data to download a JSON file. The file holds your profile, your server list, your sessions, your API and SSH keys, 90 days of audit records, and your login history. The download starts at once.

Delete your account

WARNING

Account deletion is permanent. The panel deletes your sessions, API keys, SSH keys, and notifications. It makes your audit records anonymous. Delete every server that you own first.

1. Click Delete My Account.
2. Enter your password.
3. Type DELETE MY ACCOUNT in the confirmation field.
4. Click Permanently Delete Account.

The panel signs you out and returns you to the login page.

Notification preferences

Notification preferences are not in this area. Open the notification page from the bell icon, then open Notification Preferences.

Next steps

• Dashboard for an overview of your servers
• Server management to run the servers you rent
• Support tickets to ask your provider a question