# Your profile and sign-in security

Your name and time zone, a strong password, two-step sign-in, and API tokens.

For: Everyone with a CubeSites account

## Profile and appearance

Profile holds your name, your email address and your time zone, plus how the app looks: light, dark, or matching the device. The name is what colleagues see beside anything you do, so it should be your name rather than a job title.

The email address cannot be changed here, deliberately: it is the account's proof of identity, and support changes it from the old address.

Walkthrough: Your profile and how the app looks (Profile and sign-in security)

1. **Your name**: Colleagues see it beside anything you do. Use your own name rather than a job title.
2. **Your time zone**: How times are shown to you, including publish dates and message times.
3. **Appearance**: Light, dark, or matching the device. It follows your account, not the computer.

1. Open Settings, then Profile.
2. Check the name and time zone.
3. Pick an appearance and leave it alone for a week.

## Password and two-step sign-in

Changing the password asks for the current one first, then a new password of at least 10 characters. A longer phrase beats a short puzzle; the aim is something only you could type and nobody could guess.

Two-step sign-in adds a code from an authenticator app to every sign-in. It takes two minutes to set up: the app scans a code, a six-digit number confirms it, and recovery codes go somewhere safe. It is the single most effective protection on the account, and workspace owners can require it for everyone.

Walkthrough: Password and two-step sign-in (Profile and sign-in security)

1. **Changing the password**: The current one first, then a new one of at least 10 characters. A phrase beats a puzzle.
2. **Two-step sign-in**: A code from an authenticator app on every sign-in. Two minutes to set up, and the best protection on the account.
3. **Or require it for everyone**: Workspace owners can turn it on for the whole workspace on Pro, which is what most businesses with client data do.

Warning: Keep the recovery codes somewhere other than the phone holding the authenticator. A lost phone with no recovery codes means a support round-trip to get back in.

## API tokens

API tokens, on their own page in Settings, are for scripts rather than people: a named token with exactly your permissions, shown once and stored hashed. Revoke a token the moment a script ends its useful life or you are unsure where it went.

A token is never a person. If a script needs a smaller footprint, use a workspace role that fits rather than a personal account with a broad token.

Walkthrough: API tokens from the security tab (Profile and sign-in security, then API tokens)

1. **The card**: Tokens are created from Sign-in and security, named after the script they serve.
2. **Name it after the script**: Six months from now the name is the only clue about what a token was for.
3. **Revoke promptly**: A token that is no longer needed is a risk with no upside. Revoking stops it immediately.

- [ ] Password manager in use
- [ ] Two-step sign-in on
- [ ] Recovery codes stored away from the phone
- [ ] Every API token named after its script and still needed

## Why does the time zone matter?

It is how times are shown to you, including publish dates and message times. The wrong one makes a 9am booking look like 8am.

## Can I sign out everywhere?

Changing your password signs other sessions out. That is the lever to pull if you think someone else has your password.

## Related guides

- [Automate with the API](/help/integrations/automate-with-the-api)
- [Invite people and roles](/help/workspace-and-people/invite-people-and-roles)
---

CubeSites is a trading name of Cube Systems Limited, part of Crushed Ice Group. Registered in England and Wales, company number 17220899. Registered office: Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP. ICO registration number ZC216972.

Contact: hello@cubesites.co.uk | 01234 672 617 | https://cubesites.co.uk/contact