# Account and security

> Manage your FeatherPanel account: profile, 2FA and passkeys, linked Discord, OIDC or LDAP, sessions, SSH and API keys, MCP, activity, mail and deletion.

Source: https://featherpanel.com/docs/user/account/

Open the account menu and choose **Account**. The page has seven tabs.

## Profile

Username, email, first and last name, avatar and a new password (leave it blank to keep the current one). The
**Ticket Signature** is added to your ticket replies and supports Markdown.

## Settings

- **Timezone:** dates in the panel are shown in this zone. Auto-detect follows your device.
- **Two-Factor Authentication:** time-based codes from an authenticator app.
- **Passkeys:** sign in without a password using a device PIN, fingerprint or security key. Add, rename and remove them.
- **Sign in another device:** when another device shows a QR code on its login screen, scan it or enter its
  `XXXX-XXXX` code here and approve. This works even if you signed in with Discord or SSO.
- **Linked accounts:** link or unlink Discord, an OIDC provider or an LDAP directory account, when the host enabled
  them. See [Authentication](https://featherpanel.com/docs/admin/authentication) for the admin side.
- **Active sessions:** every signed-in device with IP and last activity. Sign out one, or all others.
- **Request Your Data:** opens a support ticket asking the host for a copy of your personal data.
- **Delete Account:** only when the host allows it. You type `DELETE` and may need 2FA and an email code. Depending on
  the host's setting the account is deleted at once, after a delay you can cancel, or after your active services end.

## SSH keys

Add public keys (`ssh-rsa`, `ssh-ed25519` and others) with a name. They let you log in to your servers over SFTP
without a password. Deleted keys can be restored or deleted for good.

## API keys

API keys give scripts the same access as your account and do not expire. Each key has a public and a private part; the
private key is shown once. You can:

- limit a key to IP addresses or CIDR ranges, and get an email when it is used from another IP (at most once per 30
  minutes, needs panel mail),
- regenerate or delete a key,
- approve third-party apps on the **OAuth2 Consent** page they send you to, which creates a key for them.

See the [API guide](https://featherpanel.com/docs/api), [API authentication](https://featherpanel.com/docs/api/authentication) and [OAuth2](https://featherpanel.com/docs/api/oauth2).

## MCP

The MCP tab gives the panel's MCP endpoint URL so AI clients such as Claude or Cursor can manage your services. Claude
connects through OAuth and the panel sign-in; other clients use the URL with an API key in a header. The tools follow
the key's permissions and only cover modules enabled on the panel.

## Activity and mail

**Activity** is a searchable log of what your account did. **Mail** lists the emails the panel sent you, lets you read
them and queue a resend.

## Frequently asked questions

### How do I turn on two-factor authentication?

Open Account, Settings, and click Enable 2FA. Scan the QR code with an authenticator app and enter the code to finish.

### Can I log in to SFTP with an SSH key?

Yes. Add your public key under Account, SSH Keys. SFTP accepts either your account password or a key you added.

### How do I sign in on another computer without typing my password?

The login page can show a QR code and an 8-character code. Scan the QR code with a phone that is signed in, or open Account, Settings, Sign in another device and enter the code, then approve.