Two Kinds of Security Settings
| Setting | Applies to | Where |
|---|---|---|
| Two-factor authentication, active sessions, login email, password | Your own account | Settings → Security, Change Login Email, Change Password |
| Password policy, idle logout, 2FA for team and affiliates | Everyone on your network | Settings → Platform Settings → Security |
Two-Factor Authentication
Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app, such as Google Authenticator, Authy or 1Password, each time you sign in. Even if someone learns your password, they can't get in without your phone.
Turning it on
- Open Settings → Platform Settings → Security and click the link to manage your own 2FA, or open Two-Factor Authentication from the account menu.
- Scan the QR code with your authenticator app. If you can't scan it, type in the key shown underneath.
- Enter the 6-digit code the app shows to finish setup.
- Save your recovery codes somewhere safe, such as a password manager.
If you lose your phone, a recovery code is the only way to sign in without the app. Each code works once.
Turning 2FA on is available on Business and Pro plans. If your plan changes later, users who already set up 2FA keep being asked for their code, so nobody is locked out.
Active Sessions
Settings → Security lists every device currently signed in to your account. The device you are using now is marked as the current session.
- Log out on a row signs out that one device.
- Log out others signs out every device except the one you are using.
If you see a device you don't recognise, log it out, then change your password.
Change Login Email
Only the account owner can change the login email. Team members, affiliates and advertisers don't see this option.
- Open Settings → Change Login Email.
- Enter the new email address and your current password.
- We email a 6-digit code to the new address, and a security alert to the old one.
- Enter the code to confirm. From then on, you sign in with the new address.
The code is valid for 15 minutes. After 5 wrong attempts the request is cancelled and you start again.
Change Password
Anyone can change their own password under Settings → Change Password. The new password has to meet your network's password policy, described below.
Network-wide Security Policy
In Settings → Platform Settings → Security you set rules for every user on your network, including affiliates and advertisers.
| Setting | What it does |
|---|---|
| Idle auto-logout | Signs users out after this many minutes of inactivity. The default is 24 hours. |
| Password Policy | Basic: at least 8 characters. Medium: 8 characters including a number. Strong: 12 characters including a special character. Applies when a password is changed or reset. |
| 2FA for team and affiliates | Encourages your team and affiliates to set up 2FA. Each person still turns it on for their own account. |
| Log affiliate logins | Records affiliate sign-ins and devices. Logins by your own team are always recorded. |
| Restrict API by IP | Lets each affiliate limit their API key to a list of IP addresses, which they set on their API Access page. An affiliate with an empty list is not restricted. Changes take up to 5 minutes to apply. |
Changes to these settings, and to anyone's 2FA, are recorded in Audit Logs.
API Keys
If your plan includes API access, the Security area also has an API Keys page. There you can create keys for your own integrations, limit each key to whitelisted IP addresses, reveal a secret again (your password is required) and revoke keys you no longer use.