Profile

The Profile page is part of the FlashPanel account area. To open it from the dashboard, click your avatar at the bottom of the left menu and select Profile.

Update your personal information

On the Profile page, you can:

• Change your avatar.
• Update your Name and Email address. When you change your email, FlashPanel sends a confirmation email to the new address; the email only changes after you confirm it.
• Choose the display Language (English or Vietnamese).

Click Save changes to save.

Security page

Your password, Master Key, browser sessions, API tokens and account activity are managed on the Security page. To open it, click your avatar at the bottom of the left menu and select Security. The page has four tabs:

• Password & Master Key: change your password, generate a new Master Key, and see whether two-factor authentication (2FA) is on.
• Browser Sessions: see and log out the browsers signed in to your account.
• API Tokens: see and revoke the tokens issued to your account.
• Activity Log: review sign-ins and important changes to your account.

Change your password

1. Open the Password & Master Key tab of the Security page.
2. Enter your Current Password.
3. Enter a New Password (at least 8 characters) and enter it again in Confirm New Password. To use a random strong password, click the dice icon (Generate secure password) in the New Password field, then save the password in your password manager.
4. Click Update Password.

After you change your password, every other browser is logged out to protect your account, including browsers where you chose to stay signed in. The browser you are using stays logged in.

Changing your password does not revoke your API tokens; revoke any token you do not recognize in the API Tokens tab.

Secure your account with two-factor authentication (2FA)

You can enable two-factor authentication (2FA) in the Two-factor authentication (2FA) section of the Profile page:

1. Under Authenticator app, click Set up.
2. Scan the QR code shown on screen with the authenticator app on your phone.
3. Enter the 6-digit code from the authenticator app and click Enable authenticator app.
4. Save the recovery codes that are displayed (you can copy or download them).

Store the recovery codes securely and use them to log in if you lose access to your 2FA device. Each recovery code can only be used once. You can regenerate your recovery codes at any time with the Regenerate recovery codes button on the Profile page.

The Two-Factor Authentication card in the Password & Master Key tab of the Security page shows whether 2FA is on. Click Manage in Profile to open the Profile page.

Use 2FA

We recommend using a two-factor authentication app like Google Authenticator, Authy,... on your smartphone to manage the 2FA codes for your FlashPanel account.

Master Key

All of your sensitive data on FlashPanel (SSH keys, server credentials, ...) is encrypted with a Master Key. The Master Key is sent to your email when you register and is required when you recover your password.

The Master Key card in the Password & Master Key tab of the Security page shows whether your account has a Master Key (Configured). If you lose your Master Key:

1. In the Master Key card, enter your Current Password.
2. Click Generate New Master Key and confirm.

The new Master Key is sent to your registered email address, and the old one stops working immediately.

WARNING

Keep your Master Key in a safe place. If you forget your password and do not have the Master Key, encrypted data cannot be decrypted and you will need to restore server access manually.

Browser sessions

The Browser Sessions tab of the Security page lists the browsers that are logged in to your account, most recently active first. Each row shows:

• The browser and operating system, with an icon for the device type (computer, tablet or phone). Hover over the browser name to see its full user agent.
• This Device marks the browser you are using.
• The IP address of the session and when it was last active.

To log out other devices:

• Log out one session: click the log out icon on its row, then click Log Out to confirm. A browser where you chose to stay signed in may sign back in by itself; to be sure it is logged out, use the next option or change your password.
• Log out all other sessions: click Log Out Other Browser Sessions, enter your current password, and click Log Out Other Sessions. This also logs out browsers where you chose to stay signed in. The session in the browser you are using stays logged in.

Logging out sessions does not revoke your API tokens; revoke them separately if needed.

TIP

If you see a session you do not recognize, log it out, change your password right away and revoke any API token you do not recognize.

API access tokens

The API Tokens tab of the Security page lists the API tokens issued to your account, with each token's name, when it was last used, when it expires (if it does), and when it was created. A token lets a script or an external application call the FlashPanel API on your behalf.

• This page has no button to create a token. A token is issued when you log in through the API with your email, password (and 2FA code if enabled). See the API documentation for details.
• Only accounts with an active paid plan can be issued a token.
• Each sign-in through the API is recorded in the activity log, so you can see when and from which IP address a token was issued.
• Each time you sign in through the API, only your 10 newest tokens are kept; older tokens are deleted automatically.
• To revoke a token you no longer use, click the delete icon on its row, then click Revoke to confirm. Applications using that token can no longer call the API.

WARNING

Keep your tokens as secret as your password. If you suspect a token has leaked, revoke it immediately.

Activity log

The Activity Log tab of the Security page lists the activity recorded on your account, newest first, for example sign-ins (including sign-ins through the API) and sign-outs, account registration, password resets, password and Master Key changes, payment method, subscription and top-up events, and servers added or deleted. Each row shows the activity type, a description, the IP address it came from and when it happened.

• To show only one kind of activity, choose it in Activity Type.
• To show a period, pick the days in From and To.
• Click Clear filters to show all activity again.

TIP

If you notice an activity you do not recognize, change your password right away, check your browser sessions, and revoke any API token you do not recognize.

Usage and limits

The Usage & Limits page shows your account's current usage against your plan's limits. To open it, click your avatar at the bottom of the left menu and select Usage & Limits. The page shows:

• Servers: the number of servers you own.
• Sites: the number of websites on your servers. Unlimited with a paid plan.
• Events This Month: the number of events run this month. Resets at the end of each month (23:50 UTC on the last day). Unlimited with a paid plan.
• Events Today: the number of events run today. Resets daily at 00:00 UTC. Unlimited with a paid plan.
• Free Subdomains: the number of free subdomains your websites use. Each server can use up to 2 free subdomains, or 10 if you have a paid plan or the server was created through a FlashPanel hosting partner; the limit shown is the total for all the servers you own.
• Migrations: the number of migrations from other control panels (for example aaPanel, CyberPanel, DirectAdmin). Unlimited with a paid plan.

Each card shows your current usage and the limit (or Unlimited); items with a limit also show a percentage bar. The bar is green below 80%, orange from 80% (Near limit) and red once the limit is reached (Limit reached, or Over limit when you are above it). When an item reaches its limit, upgrade your plan or reduce your usage to continue. On the Free plan, the page also shows an Upgrade Now button that opens the Billing page.