Security and API access
Security
Settings → Security sets the sign-in rules for everyone on the account.
Password policy
| Setting | What it does |
|---|---|
| Password complexity | Require uppercase, lowercase, a number and a special character — each optional |
| Password length | Minimum and maximum. Leave the minimum empty for none |
| Enable password retrieval | Lets users reset their own password. Turn it off and only admins can |
| Password expiration | Days before a password must be changed, or never |
Leaving password retrieval on is usually right: turning it off means every forgotten password becomes an admin task, and a delay for the person locked out.
Two-factor authentication
Enable 2FA turns on a verification code, emailed to the user at sign-in. 2FA expiration sets how often they're asked — every sign-in, or less often.
TIP
2FA is the single largest improvement you can make to the account's security, and it costs users a few seconds. If your data is commercially sensitive — and in this platform it generally is — turn it on.
Changes here apply to everyone. Enabling 2FA or tightening the password policy affects users at their next sign-in, so it's worth telling people first.
API access
Settings → API Access manages tokens for reading data programmatically, without going through the dashboard.
Each token shows an Allowed toggle, its name and description, a masked token, its permissions, when it was created and when it expires, and its status — Active or Expired.
Tokens carry a group's permissions
The Permissions column shows a user group, and that's exactly what the token gets: a token sees precisely what a member of that group would see, rule set and filter rules included.
That makes the group choice the security decision. A token attached to a broad group is a broad key — so attach tokens to the narrowest group that does the job, exactly as you would a person.
Managing tokens
New API token creates one. Give it a name and description that say what it's for and who owns it — "for downloading historical data for forecasting" is much easier to audit later than "token 3".
- Allowed switches a token off without deleting it — the quickest response if one may have leaked
- Expired tokens stay listed for the record
WARNING
A token is shown in full only when it's created; afterwards it's masked. Store it somewhere safe at that moment. If it's lost, issue a new one and switch the old one off — and treat a token like a password, because that's what it is.
Reviewing this list occasionally is worth the minute it takes: tokens outlive the projects that needed them, and an active token belonging to nobody in particular is exactly the thing to switch off.