Security

“Security” is in “Settings”, under “Account”. It was called Security & Authentication until September 2026. It is visible to the account owner only, and the platform refuses these requests for anyone else regardless of what the interface shows.

Change password

“Change password” asks for your current password and the new one twice. A mismatch or an empty field is answered in the form rather than by a silent refusal to save.

An account created through Google or Microsoft has no password to change. See Sign in with Google or Microsoft.

Two-factor authentication

The “Two-factor authentication” card is here. Setting it up, recovery codes and disabling it are covered in Two-factor authentication.

API keys and webhooks

They used to be on this section. Since September 2026 they have their own, “API keys & webhooks”, also for the account owner only. See API keys.

Active sessions

“Active sessions” lists where your account is signed in, and lets you revoke any of them or use “Revoke all other sessions”.

Read the note on the card rather than assuming: a revoked device is signed out the next time it refreshes, so revocation is not instantaneous. See Sign out and sessions.

If you think an account is compromised

Do all four: change the password, revoke other sessions, regenerate recovery codes if two-factor authentication is on, and revoke any API key you cannot account for. Doing only one of them leaves a way back in.