> ## Documentation Index > Fetch the complete documentation index at: https://docs.zespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Account security: password, sessions, and terminals > Change your password, set up two-factor authentication, see where you're signed in, and sign out browsers or revoke CLI terminals from Settings → Profile → Security. This page covers the security of **your own Zespan sign-in**. Everything here lives under **Settings → Profile → Security** and applies to you alone. For how Zespan protects your data, see [Security](https://docs.zespan.com/platform/security.md). To require two-factor authentication from your whole team, see [Organizations](https://docs.zespan.com/account/organizations.md#requiring-two-factor-authentication). ## Change your password If you sign in with an email and password, the **Password** card lets you change it while signed in. **1. Enter your current password** You must know it to change it. A wrong current password is refused with "Your current password isn't right." **2. Choose a new password** Use **12 to 128 characters**, and type it twice. A mix of letters, numbers, and symbols is recommended, and so is avoiding common words and your own name or email. **3. Decide about your other sessions** **Sign out of all my other sessions** is ticked by default. Leave it ticked if you think someone else might have had your old password. If you sign in with Google, GitHub, or Microsoft, the card says so and there is no Zespan password to change; manage it with that provider. If you forgot your password, use **Forgot password** on the sign-in page instead. ## Two-factor authentication Two-factor authentication asks for a code from an authenticator app (Google Authenticator, 1Password, Authy, or similar) every time you sign in. **1. Start setup** Click to turn on **Two-factor authentication**. If you sign in with a password, enter it to continue. **2. Scan and confirm** Scan the QR code with your authenticator app, then enter the 6-digit code it shows. **3. Save your backup codes** The backup codes are shown **only during setup**. Copy or download them, then tick **I've saved my backup codes**. Each can be used if you lose your phone. If you leave before confirming, two-factor stays off and you start again. To turn it off, use the same card; you confirm with your password if you sign in with one. Your backup codes stop working when you turn it off. > [!NOTE] > > If an organization you belong to requires two-factor authentication, only an authenticator app satisfies it. Email one-time codes don't. See [Organizations](https://docs.zespan.com/account/organizations.md#requiring-two-factor-authentication). ## Where you're signed in **Where you're signed in** lists every active session on your account: browsers and CLI terminals. | Column | Meaning | | - | - | | **Device** | The browser and operating system, or **CLI terminal**. Your current session is marked **This device**. | | **IP address** | The network address, [shortened for privacy](https://docs.zespan.com/account/privacy.md#ip-addresses-are-stored-truncated). | | **Signed in** / **Last active** | When the session started and when it was last used. | * **Sign out** next to a session ends it right away. You can't sign out your current session from this list; use the normal sign-out instead. * **Sign out all other sessions** ends every session except this one, terminals included. If you don't recognize a session, sign it out and then change your password. Session tokens are never shown, and you can only see and end your own sessions. Each sign-out is recorded in the [audit log](https://docs.zespan.com/platform/audit.md) as `user.session_revoked`. ## Terminals (CLI) **Terminals (CLI)** lists the machines you authorized with [`zespan auth login`](https://docs.zespan.com/cli/auth). Each shows its operating system and CLI version, a short key fingerprint, when it was first and last seen, and how many sessions it currently holds. **Revoke** signs the terminal out and ends every session it holds. A revoked terminal can't sign itself back in: the CLI explains how to start fresh — see [`zespan auth` → When a login fails](https://docs.zespan.com/cli/auth#when-a-login-fails). Revoking is recorded as `user.cli_device_revoked`. These lists stay available even when your organization requires two-factor authentication and you haven't enrolled yet, so you can always end a session. ## From the API These routes act on the signed-in user and authenticate with your dashboard session (browser cookie), not `x-api-key`. | Route | What it does | | - | - | | `GET /v1/user/sessions` | Your unexpired sessions: `id`, `createdAt`, `updatedAt`, `expiresAt`, `ipAddress`, `userAgent`, `deviceId`, and `current`. | | `DELETE /v1/user/sessions/{id}` | Ends one of your other sessions. Returns `204`; `400` for your current session; `404` if it isn't yours. | | `POST /v1/user/sessions/revoke-others` | Ends all your other sessions. Returns `{ "revoked": }`. | | `GET /v1/user/cli-devices` | Your authorized terminals, with `activeSessions` and `revokedAt`. | | `DELETE /v1/user/cli-devices/{id}` | Revokes a terminal and ends its sessions. Returns `204`; `404` if it isn't yours. | ## Next steps * [Privacy](https://docs.zespan.com/account/privacy.md) — your privacy choices, data export, and account deletion * [`zespan auth`](https://docs.zespan.com/cli/auth) — sign the CLI in and approve a terminal * [API keys](https://docs.zespan.com/account/api-keys.md) — project keys and personal keys for MCP * [Organizations](https://docs.zespan.com/account/organizations.md#requiring-two-factor-authentication) — require two-factor for your team This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.