Account security

Your account has two kinds of credentials: your email and password, which sign you in to the dashboard, and API keys, which your code uses. Protect both. Everything on this page is under Settings unless it says otherwise.

Verify your email address#

When you sign up, we email you a link. Open it to verify your address. Until you do, the dashboard shows a reminder with a Send the link again button. The link works for 48 hours and only once.

A verified address is needed for free credit. We also use it to tell you about changes to your account, such as credit we remove.

Turn on two-factor authentication#

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app each time you sign in. Any app that supports time-based codes (TOTP) works, such as Google Authenticator, 1Password or Authy.

1. 1

   Start setup

   In Settings, under Two-factor authentication, click Set up two-factor.

2. 2

   Add the account to your app

   Scan the QR code with your authenticator app, or type in the setup key shown next to it.

3. 3

   Confirm a code

   Enter the 6-digit code the app shows and click Verify & enable. The status changes to On.

4. 4

   Save your recovery codes

   You get ten recovery codes, such as k7mq-2xpd. Each one signs you in once instead of an authenticator code. They are shown only this once: click Copy codes, store them in your password manager, then click I saved them.

From then on, signing in takes your email, your password and a current code.

If codes are rejected, check that your phone sets its clock automatically. Codes are accepted up to about 30 seconds early or late.

Sign in with a recovery code#

Lost your phone? At the code prompt, type one of your recovery codes instead of the 6-digit code. Upper or lower case and the dash don't matter. Each code works once; Settings shows how many unused codes you have left.

Get new recovery codes#

Under Two-factor authentication, enter a current authenticator code next to Generate new codes. You get ten new codes and every old one stops working. Do this when you have used some of them or think they were seen by someone else.

Turn two-factor off#

Enter a current authenticator code or a recovery code next to Turn off two-factor and click Turn off. The setup key and the recovery codes are deleted. Turning 2FA on again gives you a new QR code, so remove the old entry from your app.

What two-factor protects#

Two-factor protects dashboard sign-in: your balance, billing, keys and logs. It doesn't apply to API requests. An API key works on its own, with no second factor, so treat every key like a password.

Change your password#

Under Change password, enter your current password and a new one of at least 8 characters, then click Update password. Every other browser signed in to your account is signed out; the one you are using stays signed in.

Sessions#

Signing in keeps you signed in on that browser for 30 days. Sign out, at the bottom of the dashboard sidebar, ends the session on that browser.

The Sessions card in Settings shows how many other browsers or devices are signed in. Sign out other sessions ends all of them and keeps you signed in here. Use it after signing in on a shared computer, or if you think someone else has access to your account.

Keep API keys safe#

• Create a separate key for each app and environment, and give it only the limits and models it needs. See API keys.
• Keep keys in environment variables or a secrets manager, never in code you commit or ship to users.
• Rotate keys regularly, and revoke a key immediately if it may have leaked. Revocation applies to the next request.
• Check Logs for requests you don't recognise. Each request shows the key that made it.

More in Keep keys safe.

What Lovely Router stores#

Language#

Pick English, 中文, 日本語 or Русский under Language in Settings, or from the selector in the sidebar or the docs header. The choice applies to the dashboard and docs on that browser. Until you choose, Lovely Router follows your browser's language.