Profile & Security

After signing in, click Profile in the left navigation to open /profile. From here you can view and manage account information, account bindings, notification and behavior preferences, interface language, the personal sidebar, check-in, 2FA, passkeys, the access token and login sessions.

View account information

See account information including your name, user ID, remaining balance, total quota consumed and API request count.

Manage account bindings

Account bindings cover your email address and third-party OAuth accounts.

Bind an email address

1. In the settings area, go to Account bindings → Email and click Bind.
2. Enter the email address you want to bind.
3. Click Send to request a verification code.
4. Enter the code and click Bind email.

Bind a third-party OAuth account

1. In the settings area, go to Account bindings → Third-party OAuth accounts.
2. Click Bind next to the provider you want.
3. You are redirected to that provider’s authorization page. Sign in and click Authorize.
4. After authorization you are returned automatically and the binding status changes to Bound.

Set notification and behavior preferences

This page configures how the account receives notifications and how the system behaves for you.

Notification settings

• Notification channel: choose email, webhook, Bark or Gotify for system notifications.
• Balance warning threshold: set the balance at which a warning is sent when the account falls below it.
• Notification email: the address that receives notifications. Left blank, the account’s bound email is used.

Fill in the fields and click Save settings to apply the changes.

Behavior preferences

• Accept unpriced models: when enabled, allows the use of models that have no configured price (not recommended).
• Record IP address: when enabled, records the IP address of model calls and of failed requests.

Fill in the fields and click Save settings to apply the changes.

Caution

Enabling Accept unpriced models can lead to unexpectedly large charges. Leaving it off is recommended.

Set the interface language preference

You can set an interface language preference. It syncs to every device this account signs in on, and it also affects the language of API error messages.

Personalize the sidebar

This area customizes which feature modules appear in the left sidebar, so you can show or hide entries to match how you work.

Note

This setting only changes your own navigation. It does not grant new permissions and does not disable the corresponding endpoints.

Daily check-in

Use this area to check in each day and review your check-in history and rewards.

• Click Check in now to claim a random quota reward for the day; the amount varies within a set range.
• The page shows cumulative check-in days, quota earned this month and quota earned in total.
• You can check in only once per day. Rewards go to the account balance and may take a moment to arrive.

Security settings

This area manages the account’s security configuration and access permissions.

• Change password: update the account sign-in password.
• Access token: generate and manage the API access token used by external applications or services to reach the management endpoints.
• Delete account: permanently delete the current account and all of its data. This cannot be undone — confirm carefully before proceeding.

Reset the access token

If you suspect the API access token has leaked, reset it:

1. Find the Security settings area on the profile page.
2. Click Access token → Regenerate.
3. Confirm the action and the system issues a new API access token.
4. The old token stops working immediately, so every integration using it must be reconfigured.

Danger

The access token is for account management endpoints and is different from the API key used to call models. Do not paste it into a third-party AI client. Resetting the access token invalidates every existing access token, and they must be created again.

Enable or disable two-factor authentication (2FA)

This area enables or disables two-factor authentication for the account, adding a layer of protection beyond the password.

1. Enable 2FA: on the profile page, click Enable next to Two-factor authentication.
2. Scan the QR code: scan the QR code with an authenticator app such as Google Authenticator or Microsoft Authenticator, or enter the secret manually.
3. Save the backup codes: store the backup codes the system generates. Each code can normally be used only once, and they restore access when the authenticator is unavailable.
4. Enter the verification code: open the authenticator app and enter the current six-digit code.
5. Finish: click Enable 2FA. Once verified, two-factor authentication is active.
6. Regenerate backup codes or disable 2FA: click Regenerate backup codes or Disable 2FA and follow the prompts.

Caution

Backup codes are shown only once and cannot be viewed again after the dialog closes, so save them to a password manager or write them down now. If you lose your phone, reinstall your OS or switch authenticators, the backup codes are the only way back into the account; if both the codes and the authenticator are gone, recovery means contacting support.

Enable or disable passwordless passkey sign-in

You can enable or disable passkey sign-in for the account. Once enabled, you can sign in with your device’s biometrics, screen lock or a security key instead of a password.

1. Enable passkey: in the Passkey sign-in area, click Enable passkey.
2. Complete the security check: enter the six-digit code from your authenticator app, or an eight-digit backup code, and click Verify.
3. Register the passkey: the browser shows a system prompt. Complete the fingerprint, face, PIN or other system verification to register the passkey.
4. Check the status: after registration the page shows Passkey authentication · Enabled along with the time it was last used.
5. Unbind the passkey: to turn the feature off, click Unbind passkey and complete verification to remove passkey sign-in from the account.

Login session management

This area shows and manages the account’s sign-in sessions across devices and browsers, so you can spot and remove unfamiliar sign-ins quickly.

• View session details: see the signed-in device, operating system, browser, IP address, sign-in method, last active time and session expiry.
• Sign out of a session: click Sign out or Revoke next to a session to sign that device out of the account.
• Sign out of other sessions: click Sign out other sessions in the top right to sign out of every device except the current one.
• Manage sign-in status: if you see an unfamiliar device or an unusual sign-in, revoke that session immediately and change the account password.