Account and sign-in
Confirm your email, recover access and set allowed playback domains.
On this page
Sign in and recover access
Sign in using the method associated with your account: an email and password, Google or GitHub. For a provider account, recover access through that provider. A provider-only account has no password to change in the dashboard.
Request a password reset
From Log in, select Forgot your password?. Enter your email and click Send reset link. Check your inbox and spam folder.Use the newest link
Reset links last 24 hours; requesting another replaces the previous link. Open the newest email and choose your new password.Sign in again
After the reset, use the new password. Older login sessions are invalidated. Administrator accounts use the operator recovery process.
The reset page shows the same request confirmation whether an address is eligible or not. If reset emails are unavailable, follow the displayed support message rather than repeatedly requesting a link.
Change your password
Open Settings → Password. Enter Current password, New password and New password again, then click Change password. Use at least ten characters and a password you do not use elsewhere.
The confirmation tells you that other browsers have been logged out. If you sign in through Google or GitHub, manage that provider’s password and security settings instead.
Restrict playback domains
Open Settings → Allowed domains and list one hostname per line. An empty list allows any site. Settings apply across Main and all projects.
| Entry | Allows |
|---|---|
example.com | Only example.com. |
www.example.com | Only the www host. |
*.example.com | Subdomains such as www.example.com, but not example.com itself. |
localhost or 127.0.0.1 | Local website testing. Other IP addresses are not accepted. |
List both the apex domain and wildcard if you use both. Schemes, ports and paths do not define separate allowed sites. Playback-token domain settings can narrow account restrictions, but cannot widen them.
Protect server secrets and operator access
Keep API keys and webhook signing secrets in server-side secret storage. Use narrowly scoped integration keys and revoke unused ones. Visitors should receive embeds or playback links, never your API key.
Operators add the displayed setup key to an authenticator app and enter a six-digit code. Setup expires after ten minutes. Save the one-time recovery codes shown after enrollment. Verification lasts up to 12 hours in that browser; replacing recovery codes invalidates old codes and other browsers’ operator verification.