Securing your account

Hosting accounts are high-value targets — someone who takes yours gets your domains, your code, and your customer data. Turn on 2FA on day one.

Enable 2FA (TOTP)

1. /dashboard/profile → Security.
2. Click Enable two-factor.
3. Scan the QR with any authenticator app — Google Authenticator, Authy, 1Password, Bitwarden, all work.
4. Enter the 6-digit code to confirm.
5. Save the 10 backup codes that appear next. Each one works once. Print them, drop them in a password manager, keep them somewhere that isn't on the same machine that runs your authenticator.

After 2FA is on, every login asks for the code.

If you lose your authenticator

Use one of the backup codes you saved. Each is single-use. You can regenerate the whole set from the same security page if you're running low — old ones invalidate the moment you generate new ones.

If you lose both the authenticator AND the backup codes, open a support ticket. We'll verify your identity (account email + recent billing card) and reset 2FA. Plan a few hours; it's manual.

Connected accounts

If you signed up with email, you can link Discord, GitHub, or Google for one-click sign-in. /connected-accounts.

Linking does not remove your password — both work after that. Unlinking later is fine; just keep at least one way in.

Password hygiene

• Use a password manager. We won't lecture you, but please.
• Don't reuse your Suzko password anywhere else.
• Change it from Profile → Security if you suspect leakage — we'll log out every other session immediately.

Login alerts

You'll get an email + (optional) push notification when a new device signs in. If you didn't make that login, change your password and hit the chat. We'll lock the account while we sort it.

API tokens

If you use the API or the MCP server, treat tokens like passwords. You can revoke any token from Profile → API Tokens — the next request with it returns 401 immediately.