Password and 2FA
Set a unique password in My account and enable two-factor authentication where available. Your 2FA QR code is secret. Store recovery codes outside the hosting service. Administrator accounts use a password and their own security verification; Google sign-in does not bypass this protection.
API keys
Manage panel keys in your account settings. Give each integration its own key, restrict access where possible and revoke unused keys. Never place an API key in client-side JavaScript or a public repository.
Collaborators
Share service access through its user management, not by sharing your own credentials. Grant only the permissions needed. File access can expose application tokens. When collaboration ends, remove access and rotate any secrets the person could have accessed.
Activity history
Recorded account and service activities are visible according to your permissions. Not every application action is a panel audit event. This guide does not promise full management or bulk sign-out of all active devices; contact support if you suspect compromised access.