All courses

Account security

Password, two-step verification, sessions, the organization's audit log and API keys.

Video transcript

In this video, you'll see how to protect your account, how API keys work and where every action is recorded.

You change your password here, with the current one and the new one: at least 12 characters, with uppercase, lowercase, a number and a symbol.

What protects you most is two-step verification, with an authenticator app like Google Authenticator or Authy.

You copy this key into your app and, from then on, signing in asks for a 6-digit code. We won't turn it on here.

If you connect another system, you create its key here, with only the permissions it needs.

The key is shown only once: keep it in a secrets manager, never in a chat.

If it's lost or no longer used, you revoke it and it stops working right away.

And everything goes into the activity log: who invited someone, changed the settings or created a key, like the one we just created.

You can filter it by action type and by date, and any member can check it.

In the next video, you'll see what to do when something isn't working.

Your password

You change it under Account → Security, entering your current one and the new one. Bruxel requires at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol.

If you sign in with “Continue with Google”, your password is managed by Google, not Bruxel: change it from your Google account. The form on this screen is for accounts registered with an email address and password.

Two-step verification

It's the protection that pays off most for how little it costs to turn on, and it's enabled from the same screen.

  • It works with an authenticator app: Google Authenticator, Authy, 1Password or equivalent. You scan a QR code, or copy the key by hand if your app doesn't read codes.
  • There's no SMS option: the second factor is always the authenticator app.
  • Once enabled, every sign-in asks for the 6-digit code as well as your password. You can turn it off from the same place.

Changing your account's email

It takes two steps: you enter the new address, Bruxel sends a code to it, and the change applies once you enter the code. That way nobody can move your account to an address they don't control. Don't mix it up: this is your sign-in address, separate from the organization's billing email, which is set under Billing.

Signing out

When you sign out, that session stops being valid immediately on the server side: it doesn't stay alive until it expires on its own. If you suspect someone else got into your account, sign out and change your password.

There's currently no list of connected devices and no “sign out everywhere” button: signing out ends the session you're signing out from, not the others. If you believe your account is compromised, the route is to change your password and turn on two-step verification; and if you administer the organization, check the audit log to see what was done.

The organization's audit log

Every relevant action is recorded: who invited someone, who changed settings, who approved content, who bought credits. It lives under Account → Audit, can be filtered by action type and by date, and any member can read it, not just administrators.

API keys

If you connect Bruxel to another system, keys are created and revoked under Account → API keys. Creating or revoking them requires the admin or owner role.

The key is shown ONCE, when you create it. If you lose it there's no way to see it again: you revoke it and create another. Keep it in a secrets manager, never in a chat or a shared document — whoever holds the key can operate your organization.

Your data

An admin can download everything in the organization as a single file from Account → General, and anyone can delete their own account from the danger zone on this screen. Before deleting it, read the Organizations guide: if you're the only owner, it isn't just your account that goes but the entire organization.