Workspace and people
Your profile and sign-in security
Your name and time zone, a strong password, two-step sign-in, and API tokens.
- 3 minute read
- 3 interactive walkthroughs
- For everyone with a CubeSites account
Profile and appearance#
Profile holds your name, your email address and your time zone, plus how the app looks: light, dark, or matching the device. The name is what colleagues see beside anything you do, so it should be your name rather than a job title.
The email address cannot be changed here, deliberately: it is the account's proof of identity, and support changes it from the old address.
- Home
- Websites
- Licences
- Templates
- Media
- Cube apps
- Settings
About you
Password
Current passwordNew passwordChange passwordTwo-step sign-in
Add a code from an authenticator app to every sign-in.
Begin setupAPI tokens
Create a named token for a script.Create tokenRequire two-step sign-in for everyone
ProOff for this workspaceStep 1 of 3
Your name
Colleagues see it beside anything you do. Use your own name rather than a job title.
Reduced motion is on, so the walkthrough waits for you. Use the arrows or pick a step.
- 1Open Settings, then Profile.
- 2Check the name and time zone.
- 3Pick an appearance and leave it alone for a week.
Password and two-step sign-in#
Changing the password asks for the current one first, then a new password of at least 10 characters. A longer phrase beats a short puzzle; the aim is something only you could type and nobody could guess.
Two-step sign-in adds a code from an authenticator app to every sign-in. It takes two minutes to set up: the app scans a code, a six-digit number confirms it, and recovery codes go somewhere safe. It is the single most effective protection on the account, and workspace owners can require it for everyone.
- Home
- Websites
- Licences
- Templates
- Media
- Cube apps
- Settings
About you
Password
Current passwordNew passwordChange passwordTwo-step sign-in
Add a code from an authenticator app to every sign-in.
Begin setupAPI tokens
Create a named token for a script.Create tokenRequire two-step sign-in for everyone
ProOff for this workspaceStep 1 of 3
Changing the password
The current one first, then a new one of at least 10 characters. A phrase beats a puzzle.
Reduced motion is on, so the walkthrough waits for you. Use the arrows or pick a step.
Before you continue: Keep the recovery codes somewhere other than the phone holding the authenticator. A lost phone with no recovery codes means a support round-trip to get back in.
API tokens#
API tokens, on their own page in Settings, are for scripts rather than people: a named token with exactly your permissions, shown once and stored hashed. Revoke a token the moment a script ends its useful life or you are unsure where it went.
A token is never a person. If a script needs a smaller footprint, use a workspace role that fits rather than a personal account with a broad token.
- Home
- Websites
- Licences
- Templates
- Media
- Cube apps
- Settings
About you
Password
Current passwordNew passwordChange passwordTwo-step sign-in
Add a code from an authenticator app to every sign-in.
Begin setupAPI tokens
Create a named token for a script.Create tokenRequire two-step sign-in for everyone
ProOff for this workspace- Home
- Websites
- Licences
- Templates
- Media
- Cube apps
- Settings
API tokens
A token lets a script work with this workspace's sites and messages.
Create a token
Your tokens
shown once, then hiddenCopyReporting scriptRevokeA token carries your permissions. Never share one, and revoke it if it is lost.
Step 1 of 3
The card
Tokens are created from Sign-in and security, named after the script they serve.
Reduced motion is on, so the walkthrough waits for you. Use the arrows or pick a step.
- Password manager in use
- Two-step sign-in on
- Recovery codes stored away from the phone
- Every API token named after its script and still needed
Common questions
Why does the time zone matter?
It is how times are shown to you, including publish dates and message times. The wrong one makes a 9am booking look like 8am.
Can I sign out everywhere?
Changing your password signs other sessions out. That is the lever to pull if you think someone else has your password.
Related guides
Something here out of date, or a step that did not match what you see? Tell us and we will correct the guide. Never send a password or an API token.