Account & Security

Two-factor login

With two-factor login on, signing in also asks for a 6-digit code from an authenticator app - after your password and after Discord or GitHub sign-in alike. Someone who learns your password still cannot get in.

• Turn it on in Dashboard → Settings → Two-factor login: scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy…) or type in the key, then confirm with a current code.
• You then get 10 recovery codes, shown once. Each one signs you in once if your phone is not at hand - keep them in a password manager. You can create a new set at any time; the old codes stop working.
• Turning two-factor login off, or creating new recovery codes, needs a current code or a recovery code.
• After 5 wrong codes, the code step is locked for 15 minutes.
• We email you whenever two-factor login is turned on or off.
• Lost your phone and your recovery codes? Write to support@zentislabs.com from your account’s email address. Once we have confirmed it is you, we turn two-factor login off, and you get an email about it.

API Key Management

Your primary API key provides full access to your account’s API endpoints. Regenerate it from the Dashboard if you suspect it has been compromised.

Regenerate API Key

# Your API key is available in Dashboard → Settings (fastest: click Regenerate there)
# Format: zl_live_ followed by 48 hex characters

# Regenerate your API key (invalidates the old one) with your dashboard login token
curl -X POST https://api.zentislabs.com/api/v1/user/regenerate-api-key \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

# Response
{
  "success": true,
  "data": { "apiKey": "zl_live_..." }
}

# Check your current account info
curl https://api.zentislabs.com/api/v1/account \
  -H "X-API-Key: YOUR_API_KEY"

Additional named keys

Create up to 10 more keys in Dashboard → Settings → API Key, one per integration, so a key that leaks or is no longer needed can be revoked without touching the others. Each key shows when it was last used. We store only a hash of each key: it is shown once, when you create it. Up to 20 key changes an hour.

# Additional named keys: create, list and revoke them with your dashboard login token.
# They authenticate exactly like the primary key (X-API-Key header).

# Create one - the response contains the key once; store it right away
curl -X POST https://api.zentislabs.com/api/v1/user/api-keys \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Production scraper"}'

# Response
{
  "success": true,
  "data": {
    "id": "8c1f…",
    "name": "Production scraper",
    "prefix": "zl_live_3f9a",
    "last4": "c0de",
    "createdAt": "2026-09-28T09:00:00.000Z",
    "lastUsedAt": null,
    "key": "zl_live_…"
  }
}

# List them (never includes the keys themselves)
curl https://api.zentislabs.com/api/v1/user/api-keys \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

# Revoke one - it stops working immediately
curl -X DELETE https://api.zentislabs.com/api/v1/user/api-keys/KEY_ID \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Password & sessions

• Changing or resetting your password ends all existing sessions on every device.
• Regenerating your API key stops the old key immediately - update your integrations right after.
• Dashboard → Settings → Security activity lists the last 90 days of sign-ins, failed sign-ins and security changes, with the device and IP address each came from.
• “Sign out everywhere” (in Security activity) ends every session at once, including the one you are using.
• Suspended accounts cannot use the dashboard or the API.