Two-factor, passkeys and sessions

Two-factor with an app

Under Account → Profile & security, turn on TOTP at Two-factor sign-in with Set up: scan the QR code with an authenticator app (or type in the key), enter the Code from the app and click Confirm. Right after that we show you recovery codes.

Turn off is in the same place, with your password and a code from the app. The dashboard has no separate button for new recovery codes at the moment: turn two-factor off and on again to get new codes.

Passkeys

A passkey lets you sign in without a password: Face ID, Windows Hello, a fingerprint or a security key. On the sign-in page, click Sign in with a passkey. A passkey is bound to the domain: one created for citexnode.com only works there.

You add a passkey under Account in the Passkeys section: optionally enter a name (e.g. Laptop), click Add passkey and confirm your device's prompt. You can also rename or remove passkeys there. The dashboard does not let you remove the last way into your account: if you have no password and only one passkey, set a password first.

Signing in with Discord and other providers

The sign-in page has buttons such as Continue with Discord for the providers that are currently set up. Linking means: the same person, one account. The new dashboard has no page for linking a provider later or removing a link at the moment; open a ticket for that.

API tokens

For scripts and monitoring, create a personal token under Account → API tokens with New token: Name, Permissions (Read only or Read & write) and how long it is Valid for (30 days, 90 days, 1 year or no expiry). The token is shown exactly once, so copy it right away. At most 10 tokens can be active at the same time.

Tokens may read and control services, but never your account, money, orders, deletion or credentials. Revoke makes a token invalid immediately. More in API and embedding the status page.

Sessions

Every sign-in creates a session. Under Account → Profile & security → Signed-in devices you see them all with device, IP address and last access. You end individual ones with Sign out. Changing your password under Change password ends all other sessions; the current one stays.

If an old sign-in state is used a second time, we end the whole chain automatically. That is what a stolen token looks like, and we would rather sign you out once too often.

Sign-in emails

When you sign in, we send an email with a link. If it was not you, open it and you land on the "Wasn't that you?" page: Sign out this device only ends the sign-in from the email, Sign out all devices ends every session of your account. Then it is best to set a new password and turn on two-factor sign-in.

Support PIN

The dashboard overview used to show a support PIN. The new dashboard no longer shows it. So send requests about your account as a ticket from the dashboard; that makes it clear they come from your account.