User Settings & Connections

Last updated at November 1, 2026

Account settings manage your personal developer profile, authentication credentials, active browser and terminal sessions, and connected AI agents.

General Profile

Manage public profile attributes from Settings → General:

Avatar: Displayed in the top navigation header and on workspace member lists. Accounts registered with email and password get a generated identicon, while Google sign-ups retain their Google photo. Hovering over the avatar and pressing the regenerate button generates a fresh avatar at any time.
Display name: Your public developer name shown across shared projects.
Username: Your unique account namespace (e.g. apivault.tech/username) used in project URLs. Words reserved for system routes — such as docs, dashboard, and settings — cannot be claimed, including during automatic username assignment.
Email address: Your primary account email and its verification status.

Security & MFA

Configure account protection from Settings → Security & MFA:

Password: Set or update your account password. Requires verification of your current password.
Passkeys & biometrics: Register WebAuthn passkeys (Touch ID, Face ID, Windows Hello, or hardware security keys) for phishing-resistant passwordless sign-in.
Multi-factor authentication: Enable time-based one-time password (TOTP) 2FA using Google Authenticator, 1Password, or any standard authenticator app.

New accounts can also be guided through 2FA setup during onboarding. For details on brute-force attempt limits and OTP verification, see Security → Authentication.

Sessions & Devices

Review and audit all active credentials from Settings → Sessions & Devices:

Web & browser sessions: Inspect current and past browser sessions with IP address, browser user-agent, and last active timestamp. Revoke any unrecognized session instantly.
CLI connections & tokens: View devices paired via apivault login. CLI tokens are bounded to 90 days. Revoke a CLI token to instantly disconnect a lost or decommissioned machine.

MCP Connections

Inspect and revoke AI coding assistants connected via Model Context Protocol in Settings → MCP Connections.

Each connection record displays the client name (e.g. Cursor, Claude Desktop, Windsurf), granted OAuth scopes (keys:read, keys:write, keys:reveal), initial authorization date, and last tool invocation time.

Revoking active connections

Revoking an MCP connection immediately invalidates that client's OAuth access and refresh tokens. Any active AI agent sessions using those credentials will fail on their next tool invocation.

OAuth Connections

In Settings → OAuth Connections, link or unlink your Google account for single sign-on (SSO). Accounts require either a linked OAuth provider or an active password.

Personal Encryption Key

In Settings → Encryption Key, configure how your personal secrets are encrypted: default server-managed mode or zero-knowledge custom vault key mode.

Switching modes or changing your custom vault key re-encrypts all stored keys atomically. See Security → Encryption for full cryptographic details.

Was this page helpful?