Account and security

The account area covers customer-managed identity and security settings. Operator accounts and provider secrets remain in the separate administration boundary.

Annotated customer account security settings with password, 2FA, automation, and notifications — Account security and communication preferences are part of the supplied frontend.
Customers manage password, 2FA, API keys, and webhooks from one security area.
Notification controls let the account choose supported product and billing messages.

Profile and interactive access

Customers can maintain supported personal/company fields, password, two-factor authentication, language, theme, and notification preferences. Require 2FA for reseller and automation-capable accounts where possible, and review active access after personnel or vendor changes.

API keys

Annotated API key management dialog with a restricted service key — A customer can create separate automation credentials without sharing an interactive account password.
Each integration should have its own named key and the narrowest supported restrictions.
Key creation is a deliberate security action; store the returned secret immediately.

Create one key per application and environment.
Apply the narrowest supported permissions and source-IP restrictions.
Save the full secret in a secret manager when it is returned.
Test a safe read and one bounded workflow from the intended network.
Rotate by deploying a replacement before revoking the old key.

Webhooks

Annotated webhook management dialog with a signed endpoint — Webhook destinations connect account events to customer-owned automation.
Delivery settings define the endpoint and supported event subscriptions.
The stored endpoint is customer-owned and receives signed deliveries from ProxyRequest.

Verify webhook signatures against the exact raw body before parsing it. Persist or enqueue accepted events, return a direct 2xx, and make downstream processing idempotent because retries and duplicate delivery are possible.

Interactive account

Password and 2FA protect a person signing into the dashboard.

API key

A server-to-server credential belongs in a secret manager, never a browser bundle or proxy username field.

Proxy credential

HTTP/SOCKS credentials authorize gateway traffic, not control-plane API calls.

Webhook secret

A signing secret proves delivery authenticity; it is not a bearer token.

For request headers and API behavior, continue with API fundamentals and webhooks.