# Security of your account

> Turn on two-factor authentication, protect your payout address, manage read-only API keys, and what to do if you lose your phone.

URL: https://lananetwork.com/guide/account-security
Markdown: https://lananetwork.com/guide/account-security.md
Updated: 2026-11-05

## Turn on two-factor authentication

1. Open Account, then Security (or go to `/account/security` once signed in).
2. Start the setup and scan the QR code with an authenticator app on your phone.
3. Type the 6-digit code from the app. Two-factor authentication is on: you are asked for a code when it is needed.

It is required to request a publisher payout and to change payment details, and recommended for everyone. You can add more than one phone. Removing an app asks for a current code from it.

## Your payout address is protected

A new or changed payout address can be used 72 hours after it is saved, and every owner of the account is emailed when it changes. If you get that email and did not make the change, contact support at once: the waiting time is there so a stolen login cannot redirect your money unnoticed.

## API keys

Owners can create API keys in Account, card API keys, to read stats from a script or an AI assistant. Client keys are read only, up to 5 active keys per account, and never expire. A key is shown once: store it in a password manager. If one leaks, revoke it: that is immediate. Keys created by a member are revoked when that member is removed.

## Good habits

- Use a unique password for your Lana Network login.
- Sign in only at `app.lananetwork.com`. Check the address before typing your password.
- Nobody at Lana Network needs your password or your 2FA codes. Never send them, even to someone who says they are support.
- Give each person their own login through Team instead of sharing yours.

## If you lose your phone

Contact support from the email address of your login. Before removing your two-factor setup, we check that you own the account, with details only the account knows, such as a deposit reference, the last amount paid or a site name. A message on another channel alone is not enough. Then you sign in again and set up a new phone. Your payout address does not change on that occasion.

## If something goes wrong

- Could not start the setup: try again in a minute, then contact support.
- Forgot your password: contact support from the sign-in page.
- You see a payout address change, a member or an API key you do not know: contact support right away, then remove the member or revoke the key if you can.

## Frequently asked questions

### Is two-factor authentication mandatory?

It is required to request a publisher payout and to change payment details. For everything else it is optional but recommended.

### Can an API key move money or change campaigns?

No. Client API keys are read only.

### Do you store my visitors' data?

No raw IP address or user agent is stored, only salted hashes that change every day.

### What should I do if an API key leaks?

Revoke it in Account, card API keys: that is immediate. Client keys are read only, so a leaked key cannot move money or change campaigns.