Account and security
Profile, password and sessions
Update your details; change or reset a password; the 30-minute lockout; 90-day refresh tokens; the QR handoff from the web to the phone; and signing out.
Updated · 2 min read
Profile
- Web: Settings, Profile. iOS: Account, Profile (name, email, phone, Sign in with Apple status).
- API:
GET /api/auth/me,PATCH /api/auth/profile.
Changing the email address sends a verification link to the new one. The notification email for alerts is a separate field under Settings, Alerts, and should be an address off the domains you watch.
A 330 Hosting & Consulting hosting account can be linked from web Settings (/api/settings/hosting330/link) so support can see both; the iOS screen for it was removed in 1.6.0 because registering and transferring domains is not what the app is for.
Password
- Change: Settings, Profile (web);
POST /api/auth/change-passwordwith the current and new password. - Forgot: nhmohio.com/forgot-password sends a reset link; the token is single use and reset records are pruned after 30 days.
- Storage: PBKDF2 with 100,000 iterations; older hashes are upgraded on the next successful sign-in.
- Lockout: too many failed attempts lock the account for 30 minutes with "Account temporarily locked". Two-factor failures do not count towards the password lockout.
Sessions
A sign-in issues a short-lived access token and a refresh token that lasts 90 days of use and rotates on each refresh. The app refreshes silently and never signs you out on a network error or a failed refresh; it shows a banner. The web keeps a session cookie. Sign out (POST /api/auth/logout) revokes the session on the server and, in the app, unregisters the device from push.
QR handoff from the web to the phone
Signed in on the web and want the phone signed in without typing a password:
- Web dashboard, Account settings, Sign in on your phone: a QR code is generated (
POST /api/auth/mobile-handoff). - App, welcome screen, Scan QR code to sign in; the camera reads the code and redeems it (
POST /api/auth/mobile-handoff/redeem). - The phone is signed in to the same account.
The code is single use and expires shortly after it is shown; generate a new one if it has gone stale. The camera is used for nothing else in the app.
Sign in with Apple and two-factor
See Sign in with Apple and Two-factor authentication.
Admin impersonation
Support staff can open your account in an impersonation session to see what you see. Every impersonation is recorded in the audit log, and an impersonated session can never reach admin functions.
Common questions
I changed my password on the web; is the phone signed out? No. Existing refresh tokens stay valid. Sign out on the phone if that is what you want.
Can I see active sessions? Not yet as a list. Changing the password does not end other sessions; sign out on each device.
Keep reading
Related articles
- Signing inSign in with Apple first, email with show/hide password and reset, the QR code from the web dashboard, Face ID for a saved session, and the two-factor code.iOS app ·Updated
- Scan limit reachedEvery manual scan is metered per plan: the allowances for website, vulnerability and dark web scans, AI refreshes, audits and probes, and the reset message.Troubleshooting ·Updated
- Two-factor authenticationTime-based one-time codes from an authenticator app, set up on the web dashboard, with eight recovery codes; how the iOS app and the API behave once it is on.Account and security ·Updated