Skip to content

Preferences

Preferences contains the settings of your own account. Select Preferences from the account menu. The page offers four tabs.

Profile

Field Description
User name Your login name. Mandatory.
Full name The name shown to other members of your company. Mandatory.
Email address The address used for platform notifications. Mandatory.
Receive product updates via email Whether you wish to receive product announcements.

Select Save to apply the change.

Note

The address entered here receives account notifications. Monitoring reports for an individual project are sent to the address configured on the Monitoring tab of the project settings, which may be different, for example, a shared team mailbox.

Password

  1. Enter the new password in New Password.
  2. Enter it again in Reenter new password.
  3. Select Save.

The eye symbol at the end of each field reveals the entry, so that a long password can be checked before it is saved.

Authentication

The Authentication tab manages two-factor authentication for your account.

Select Activate under 2-Factor Authentication and follow the instructions shown. Once activated, a second factor is required in addition to your password at every sign-in.

Recommendation

The platform holds attack surface data, employee records, and leaked credentials for your organisation. Enabling two-factor authentication is the single most effective protection for that access, and we recommend it for every account, in particular, for accounts with Admin permissions or the Manager role.

API Keys

API keys allow scripts and other systems to use the platform interface without sending the account password with each request. Each key belongs to your account and has its own label, permission, and mandatory expiration date.

Column Content
Label The name of the key.
Permission Read only or Read and write.
Expiration date When the key expires. Expired keys are shown in red with a warning symbol.
Created at When the key was created. This column is hidden by default and can be enabled in the table's column settings.
Actions Edit or delete the key.

Creating an API key

  1. Select New API key.
  2. Enter an API key label that identifies where the key will be used.
  3. Set the Expiration date. The field initially contains today's date and cannot be set to a date before today. The key remains valid through the end of the selected day in your local time zone.

  4. Choose a permission:

    • Read only for integrations that only retrieve data. This is the default.
    • Read and write only where the integration must change platform data.

  5. Enter your account password under the confirmation message.

  6. If two-factor authentication is active for your account, also enter the current one-time password.
  7. Select Create.

If the credentials are invalid, the password and one-time-password fields show an error and no key is created.

Copying the generated key

After creation, the dialogue changes to a confirmation view and displays the generated API key together with a copy control.

  1. Select Copy API key.
  2. Store the value in the secret store or password manager used by the integration.
  3. Confirm that the value has been stored correctly before selecting Close.

The secret value is displayed only in this confirmation view. Closing the dialogue returns you to the API key list, which contains the label and metadata but not the secret itself. The value cannot be displayed again later.

To authenticate an API request, send the copied value in the X-API-Key header.

See the API Quick-Start Guide for request examples.

Managing keys

Task Procedure
Change the label, expiration date, or permission Select the edit control in the Actions column, make the change, and select Save. The expiration date must be today or later.
Identify an expired key Its row is red and the expiration value carries a warning symbol. Replace or edit it before attempting to use it again.
Withdraw a key Select the delete control in the Actions column and confirm Delete. Any system using it loses access immediately.

Replacing a lost, expiring, or compromised key

  1. Create a new key with the permission required by the integration.
  2. Copy and store the new value while it is displayed.
  3. Replace the old value in the integration and verify that API requests succeed with the new key.
  4. Delete the old key from the list. If compromise is suspected, delete it immediately and restore the integration with a new key afterwards.

Handling keys safely

Issue one key per integration and label it accordingly, so that a single key can be withdrawn without disrupting anything else. Choose Read only unless the integration genuinely needs to write, select the shortest practical lifetime, and rotate the key before it expires. Never place a key in source code, screenshots, tickets, or chat messages.