Account and security
Profile, password and sessions
Update your details; change or reset a password; the 30-minute lockout; 90-day refresh tokens; the QR handoff from the web to the phone; and signing out.
Updated · 3 min read
Profile
- Web: Settings, Profile. iOS: Account, Settings, Profile (name, email, phone, Sign in with Apple status).
- API:
GET /api/auth/me,PATCH /api/auth/profile.
Changing the email address takes effect at once: the new address becomes the account's email, is marked unverified, and gets a verification link. An account linked to Sign in with Apple cannot change its email here; Apple manages it. Alerts are not emailed at all (they go to the Alerts feed and the app), so there is no separate alert address to keep off the domains you watch.
A 330 Hosting & Consulting hosting account can be linked over the API (POST /api/settings/hosting330/link) so support can see both; neither the web dashboard nor the app has a screen for it.
Password
- Change: Settings, Profile (web);
POST /api/auth/change-passwordwith the current and new password. - Forgot: nhmohio.com/forgot-password sends a reset link; the token is single use and reset records are pruned after 30 days.
- Storage: PBKDF2 with 100,000 iterations.
- Lockout: six failed attempts within 30 minutes, counted by email address or by IP address, block further sign-ins with "Account temporarily locked" until the oldest failure is more than 30 minutes old. Two-factor failures do not count towards the password lockout.
Sessions
A sign-in issues an access token that lasts 7 days (24 hours for the administrator) and a refresh token that lasts 90 days of use and rotates on each refresh. The app refreshes silently and never signs you out on a network error or a failed refresh; it shows a banner. The web keeps a session cookie. Sign out (POST /api/auth/logout) ends every session on the account, on every device, web and phone; in the app it also unregisters the device from push. Changing or resetting the password does the same.
QR handoff from the web to the phone
Signed in on the web and want the phone signed in without typing a password:
- Web dashboard, Settings, Profile, QR login for the DomainGuard app, Generate QR: a QR code is generated (
POST /api/auth/mobile-handoff). - App, welcome screen, Scan QR code to sign in; the camera reads the code and redeems it (
POST /api/auth/mobile-handoff/redeem). - The phone is signed in to the same account.
The code is single use and expires shortly after it is shown; generate a new one if it has gone stale. The camera is used for nothing else in the app.
Sign in with Apple and two-factor
See Sign in with Apple and Two-factor authentication.
Support access
When you ask for help, support staff can open your account in a support session to see what you see. Each one needs a written reason, is read-only unless you asked us to fix something, and ends within 60 minutes. Staff can never change your password, email, two-factor or sign-in, create API keys, make purchases or delete the account. Every session is in the audit log and listed under Support access (web: Settings, Profile; app: Account, Settings), where one switch turns support access off and ends any open session at once. Staff signing out ends their session, never yours.
Common questions
I changed my password on the web; is the phone signed out? Yes. Changing or resetting the password ends every session on every device, so the phone has to sign in again.
Can I see active sessions? Not yet as a list. To end them all, sign out on any one device, or change the password: either signs out every device.
Keep reading
Related articles
- Signing inSign in with Apple first, email with show/hide password and reset, the QR code from the web dashboard, Face ID for a saved session, and the two-factor code.iOS app ·Updated
- Scan limit reachedEvery manual scan is metered per plan: the allowances for website, vulnerability, network and dark web scans and accessibility audits, and the reset message.Troubleshooting ·Updated
- Two-factor authenticationTime-based one-time codes from an authenticator app, set up on the web dashboard, with eight recovery codes; how the iOS app and the API behave once it is on.Account and security ·Updated