# Security

Your password, two-factor authentication and active sessions

Section: app. Audience: public. Updated: 2026-09-27.

---
**"Security"** is in **"Settings"**, under **"Account"**. It was called Security & Authentication until September 2026. It is visible to the account owner only, and the platform refuses these requests for anyone else regardless of what the interface shows.

## Change password

**"Change password"** asks for your current password and the new one twice. A mismatch or an empty field is answered in the form rather than by a silent refusal to save.

An account created through Google or Microsoft has no password to change. See [Sign in with Google or Microsoft](/app/sign-in-with-google-or-microsoft).

## Two-factor authentication

The **"Two-factor authentication"** card is here. Setting it up, recovery codes and disabling it are covered in [Two-factor authentication](/app/two-step-verification).

## API keys and webhooks

They used to be on this section. Since September 2026 they have their own, **"API keys & webhooks"**, also for the account owner only. See [API keys](/app/api-keys).

## Active sessions

**"Active sessions"** lists where your account is signed in, and lets you revoke any of them or use **"Revoke all other sessions"**.

Read the note on the card rather than assuming: a revoked device is signed out the next time it refreshes, so revocation is not instantaneous. See [Sign out and sessions](/app/sign-out-and-sessions).

## If you think an account is compromised

Do all four: change the password, revoke other sessions, regenerate recovery codes if two-factor authentication is on, and revoke any API key you cannot account for. Doing only one of them leaves a way back in.