The account menu
Account Details#
/client/details is the account's profile, in cards: Billing details (the details that appear on invoices), More details (the custom fields clients may see), the Language choice when the language button is available, and Emails you receive with switches. The sidebar's Your Account block shows the account number, status badge, member-since date, currency, credit and last sign-in. Fields listed in General Settings under "Details clients may not change" are shown but cannot be changed. Under "Emails you receive" the client ticks the kinds of email they want (general, invoices and payments, services, domains, support tickets, affiliate programme; sign-in and password emails are always sent) when "Clients may choose which kinds of email they receive" is on, and the marketing consent when that is on. Saving records what changed; when "Email staff when a client changes their details" is on, staff with account notices are told which fields changed (not when staff made the change themselves while signed in as the client).
The email address here is the account's address, where its emails go. The address a person signs in with is changed under Security Settings.
"Your files" lists the files staff uploaded to the account without "Staff only", with a download link. Needs the permission "Change the account's details" to open.
Contacts#
/client/contacts lists the account's contacts in a table (name, email, the kinds of email they receive, Edit and Delete): people who receive copies of chosen emails but cannot sign in. Add a contact asks for the person's details (name and email are required) and the kinds of email to copy. Delete removes a contact. Needs "Manage contacts".
User Management#
/client/users exists when "Account owners may invite and manage other users" is on (otherwise it says to contact you). It lists everyone who can sign in to the account with their role badge (Owner or User), permissions and last sign-in. The owner has "Everything". For another user, "N of 14, change" opens a pop-up with the permission switches. Remove takes a user's access away; a user can Leave an account themselves (they are then asked to choose another account). Invitations waiting are listed with their expiry and can be cancelled.
Invite a User opens a pop-up that takes an email address and the permissions to give (See services, See domains, See and pay invoices and Use support tickets are ticked to start with). A user who is not the owner sees only the permissions they hold themselves and cannot give more. The invitation email works for 7 days. The permissions are listed in Clients. Needs "Invite and manage other users".
Security Settings#
/client/security is about the person who is signed in, not the account, so it is open to every user and does not depend on account permissions. Badges at the top show whether two-step sign-in is on and the email address confirmed, and a notice offers Set Up while two-step is off. The cards sit side by side; every change here asks for the current password.
| Card | What it does |
|---|---|
| Your sign-in | First name, last name and the email address used to sign in. Changing the address sends "Email address changed" to the old address and a new confirmation link to the new one. |
| Change password | New password twice. Saving signs the person out of every other session and sends "Password changed". |
| Two-step sign-in | On or Off badge. Set Up shows a QR code and the key to type into an authenticator app (with a copy button); entering the code it shows turns two-step on and displays eight numbered recovery codes, each usable once, shown only this once. Turn Off removes it. |
| Security question | Shown when Settings > Security Questions has questions. The person picks a question and writes an answer; staff can check an answer on the user's page in the admin area. |
Two more cards need no password:
| Card | What it does |
|---|---|
| Your photo | Upload a JPEG, PNG or WebP picture (up to 5 MB). It is cut to a square, saved as a small JPEG in storage/photos and shown in place of the initials in the account menu. Remove the photo goes back to the initials. |
| Where you are signed in | Every browser and phone app signed in as this person and still within its time limits: the browser and system (for example "Chrome on Windows") or the phone's name, the IP address, when it was last active and when it signed in. "This device" marks the current browser. Sign out ends one session or signs the app out on that phone; Sign out everywhere else ends all others. |
Staff signed in as the client see the page but cannot change anything; a notice says so.
SSH Keys#
/client/ssh-keys keeps public SSH keys on the account (Settings > General > Other: "Clients may keep SSH keys on their account", on by default; needs "Manage services"). Add a key takes an optional name and the one-line OpenSSH public key (ed25519, RSA of at least 2048 bits, ECDSA or security-key types). The name defaults to the key's comment. The list shows each key's type, its SHA256 fingerprint and who added it when. A private key pasted by mistake is refused, never stored and not shown back. Up to 50 keys per account. Server modules receive the account's keys with each service (Modules\Account::$sshKeys) and can add them to a server they build; removing a key here does not take it off servers that already have it. Staff see and can remove the keys on the client's Users tab.
API Keys#
/client/api-keys appears when Settings > General > Other > "Clients may make API keys for the client API" is on (off by default). A user makes keys for the account they are working in: a name, Read only or Read and write, and an optional end date. The key (starting cik_) is shown once; only its SHA-256 hash is kept. The list shows the first characters, the access, the last use with its IP address and the end date; Remove stops a key at once. Up to 20 keys per user.
A key calls the client API at /api/client/v1/ACTION with the header Authorization: Bearer KEY. The actions are the client actions of the app API (client.dashboard, services.list and .get, domains.list and .get, invoices.list, .get and .pay, tickets.list, .get, .open, .reply, .close, .departments and .attachment, account.get and .update, accounts.list, store.order); answers are the same JSON. A key has exactly the permissions its user has in that account; a read-only key gets 403 read_only on actions that change something. A key stops working when its user is disabled or loses access to the account, after its end date, or when the setting is turned off (503). Staff see each account's keys, never the key itself, on the client's Users tab and can remove them.
Projects#
/client/projects (in the main menu; Settings > General > Other: "Clients may group their services, domains and tickets into projects", on by default) lets a client group what belongs together, for example one project per website. Each project has a name, notes and a colour, and shows as a card with how many services, domains and tickets it holds and how many tickets are open. A project's page has count cards, tables of its services, domains and tickets, Add to project (a list of the account's items not yet in it, in the user's permissions) and a button per row to take an item out. Delete removes only the project. A service's page shows the projects it is in next to its name.
Email History#
/client/emails lists the subject, date and status badge of every email sent to the account, 25 a page; opening one shows the message in a frame under its header. Emails that were not sent because sending is off are hidden. Needs "See emails sent".
Payment Methods#
/client/payment-methods shows the cards kept through a payment gateway that stores them as cards: brand and last four digits, expiry (red when expired), the gateway, and a Default badge; a notice explains how a card gets here when there is none. Make default picks the card charged automatically; Remove deletes the stored reference. Cards are added when paying an invoice by card with "Keep my card for automatic payments" ticked. Card numbers are never stored by CoreInto; the gateway keeps the card and CoreInto keeps a reference. Needs "See and pay invoices".
Switch Account#
/account/switch shows the accounts the person can use as choice cards, with Owner or Invited user, the account's status badge and "Working in now" on the current one. Closed accounts are not listed. A person whose sign-in is linked to no account is told to order a service to create one.
Something missing? Ask in the community or open a ticket.