Account and security

Manage your FeatherPanel account: profile, 2FA and passkeys, linked Discord, OIDC or LDAP, sessions, SSH and API keys, MCP, activity, mail and deletion.

On this page

Open the account menu and choose Account. The page has seven tabs.

Profile

Username, email, first and last name, avatar and a new password (leave it blank to keep the current one). The Ticket Signature is added to your ticket replies and supports Markdown.

Settings

Timezone: dates in the panel are shown in this zone. Auto-detect follows your device.
Two-Factor Authentication: time-based codes from an authenticator app.
Passkeys: sign in without a password using a device PIN, fingerprint or security key. Add, rename and remove them.
Sign in another device: when another device shows a QR code on its login screen, scan it or enter its XXXX-XXXX code here and approve. This works even if you signed in with Discord or SSO.
Linked accounts: link or unlink Discord, an OIDC provider or an LDAP directory account, when the host enabled them. See Authentication for the admin side.
Active sessions: every signed-in device with IP and last activity. Sign out one, or all others.
Request Your Data: opens a support ticket asking the host for a copy of your personal data.
Delete Account: only when the host allows it. You type DELETE and may need 2FA and an email code. Depending on the host’s setting the account is deleted at once, after a delay you can cancel, or after your active services end.

SSH keys

Add public keys (ssh-rsa, ssh-ed25519 and others) with a name. They let you log in to your servers over SFTP without a password. Deleted keys can be restored or deleted for good.

API keys

API keys give scripts the same access as your account and do not expire. Each key has a public and a private part; the private key is shown once. You can:

limit a key to IP addresses or CIDR ranges, and get an email when it is used from another IP (at most once per 30 minutes, needs panel mail),
regenerate or delete a key,
approve third-party apps on the OAuth2 Consent page they send you to, which creates a key for them.

See the API guide, API authentication and OAuth2.

MCP

The MCP tab gives the panel’s MCP endpoint URL so AI clients such as Claude or Cursor can manage your services. Claude connects through OAuth and the panel sign-in; other clients use the URL with an API key in a header. The tools follow the key’s permissions and only cover modules enabled on the panel.

Activity and mail

Activity is a searchable log of what your account did. Mail lists the emails the panel sent you, lets you read them and queue a resend.

Frequently asked questions

How do I turn on two-factor authentication?

Open Account, Settings, and click Enable 2FA. Scan the QR code with an authenticator app and enter the code to finish.

Can I log in to SFTP with an SSH key?

Yes. Add your public key under Account, SSH Keys. SFTP accepts either your account password or a key you added.

How do I sign in on another computer without typing my password?

The login page can show a QR code and an 8-character code. Scan the QR code with a phone that is signed in, or open Account, Settings, Sign in another device and enter the code, then approve.