Skip to content

Account Settings

Account settings control your personal profile, authentication, and API access. These settings apply to your individual account across all teams you belong to.

Profile Settings

Update your basic account information:

  • Name -- Your display name shown in team member lists and activity logs
  • Email -- Your login email and the address used for notifications and invitations

To update your profile:

  1. Click your profile in the Appliku dashboard
  2. Go to Account Settings
  3. Update your name or email
  4. Save changes

Password Management

Change your account password:

  1. Go to Account Settings
  2. Navigate to the Password section
  3. Enter your current password
  4. Enter and confirm your new password
  5. Save

Tip

Use a strong, unique password. Consider using a password manager to generate and store complex passwords.

Staying Signed In

The Log in to Appliku page has a Remember me for 7 days checkbox below the password field. It is not selected by default.

  • Not selected -- your session expires 24 hours after you sign in or after its last refresh. While a dashboard tab is open and online, it refreshes the session every two minutes, also when you do not use the tab. When you close all dashboard tabs, the session expires 24 hours later.
  • Selected -- your session stays valid for 7 days from the time you signed in, also if you close the browser and do not use the dashboard during that time. The 7-day deadline does not move. After it, the session continues as a normal 24-hour session only if a dashboard tab refreshed it during the last 24 hours before the deadline. Otherwise, you must sign in again. A remembered session never ends earlier than a normal session would.

In both cases, the session is saved in this browser and normally stays when you close the tab or restart the browser. You must sign in again earlier if the browser data for the dashboard is removed, or if the session was ended (for example, you signed out on all devices or reset your password).

If the dashboard cannot reach Appliku when it opens (a network problem or a short Appliku outage), your session stays. The dashboard shows Cannot reach Appliku and tries again automatically, with longer waits between attempts. Click Retry now to try at once, or Sign out to end the session in this browser.

With two-factor authentication, you select the checkbox on the password step. The 7 days start when Appliku accepts your code. The checkbox does not skip two-factor authentication: each new sign-in still asks for a code.

The checkbox applies only to dashboard sign-in. API tokens and the Appliku CLI do not use it, and it does not change how long they stay valid.

Signing out

Select Log Out in the account menu. The dashboard removes the session from your browser and asks Appliku to revoke it. This signs out only that browser. If Appliku cannot revoke the session (for example, the browser is offline), the session is still removed from the browser, but a copy of it stays valid until it expires. A copy of the short-lived access part of the session can work for up to 30 minutes after you log out.

These actions end all dashboard sessions on all devices at once, including remembered sessions: a password change, a password reset, generating new recovery codes, and the other two-factor authentication changes described below. If you think that someone has your session, change your password and review your API tokens.

Warning

Do not select Remember me for 7 days on a shared or public computer. Always select Log Out when you finish on a computer that other people use.

Two-Factor Authentication (2FA)

Appliku supports email codes and authenticator codes as separate sign-in methods. An account uses one method at a time. Authenticator codes use TOTP and work with Google Authenticator and compatible password managers, including 1Password and Bitwarden. Normal TOTP sign-in does not send an email.

Note

Authenticator setup is available only when it is enabled for your environment or account. If you do not see Set up authenticator app, keep using email codes.

Set up an authenticator

  1. Open Account Settings > Password & Security.
  2. Select Set up authenticator app.
  3. Enter your current password and request the confirmation email. Your email address must be verified, even if two-factor authentication is currently off.
  4. Enter the email code, then select Continue to QR setup.
  5. Scan the QR code in your authenticator or password manager. You can also copy the setup key into the app manually.
  6. Enter the app's current six-digit code and select Confirm authenticator.
  7. Copy or download the ten recovery codes. Confirm that you saved them, then sign in again. Wait for a new authenticator code: the setup code cannot be used twice.

Setup expires after ten minutes. The current method stays active until you confirm the new authenticator. A reload loses the displayed setup key; start a new setup if needed.

Warning

Recovery codes are shown only once. Keep them in a safe place. Each code works once. If you lose the confirmation page, sign in with your authenticator and select Generate new recovery codes. This replaces the entire old set.

Sign in and recover access

After your password, enter the code from your authenticator or password manager. Keep leading zeroes. You can paste a code. If codes fail, set your device clock automatically and wait for the next code.

If the authenticator is unavailable, select Use a recovery code. A recovery login keeps TOTP enabled. Replace the authenticator in account settings if you lost it. Email cannot bypass TOTP. If you have neither your authenticator nor recovery codes, contact support@appliku.com. Support must verify your identity; automatic email-only removal is not available.

TOTP codes can still be stolen by phishing. A password manager can make sign-in more convenient, but storing the password and TOTP key together means access to that vault can expose both.

Change or turn off two-factor authentication

Use Replace authenticator, Use email codes, or Turn off two-factor authentication in Password & Security. These changes require your current password and proof of the current method. A recovery code can replace a TOTP code. A switch to email also requires an email confirmation code. A replacement authenticator becomes active only after you confirm its first code.

Completed changes sign out all dashboard sessions. API tokens remain active unless you select Also revoke all API tokens; selecting it stops connected automation. Review your API tokens if you suspect someone accessed your account. Password reset also ends dashboard sessions but does not remove TOTP. It offers the same option to revoke API tokens.

API Token Management

API tokens allow programmatic access to the Appliku API. They are used by the Appliku CLI and for custom integrations.

Creating an API Token

  1. Go to Account Settings
  2. Navigate to the API Tokens section
  3. Click Create Token
  4. Give the token a descriptive name (e.g., "CLI access", "CI/CD pipeline")
  5. Choose an access level:
  6. Full access -- read and write everything: manage apps, deployments, and servers
  7. Read-only -- view logs, configuration, and status only; any write request is blocked with a 403
  8. Custom -- pick exactly what the token can do, per resource
  9. Copy the token immediately -- it is only shown once

The same three options are offered during CLI browser login, so you can create any of them directly from the dashboard or from the terminal login flow. See Giving AI agents read-only CLI access for what restricted tokens can and cannot do.

Custom permissions

Choosing Custom reveals a permission matrix with one row per resource type (Applications, Deployments, Servers, Datastores, Domains, Logs, and so on) and four checkboxes each: Read, Create, Update, and Delete.

  • Full access is a shortcut that ticks every box; Read-only ticks Read on every resource.
  • A custom token can grant, for example, Read + Create + Update on Deployments and Read on Logs while granting nothing on Servers or Team members. This lets an agent deploy and inspect logs without being able to delete or reconfigure infrastructure.
  • Every API request is checked against the token's grants for the specific resource and action it touches. A request the token does not cover is rejected with a 403 that names the missing permission, for example This API token is missing the deployments:update permission.
  • The token list shows each token's effective permissions: a simple chip for Full and Read-only, and a Custom chip (hover for the full per-resource summary) for custom tokens.

Existing Full and Read-only tokens keep working exactly as before; a token created without any permission selection defaults to Full access.

Limiting a token to specific teams and apps

Below the permission matrix, optional team and app pickers let you limit where a token can act. Leave them empty — the default, labelled "All teams and apps" — and the token keeps full account reach. Pick one or more teams and/or apps to restrict it:

  • A team covers all of that team's apps (now and in future) and team-level actions on it.
  • An app covers that one app only; the token cannot create apps or act on the team as a whole.

The pickers appear both in the dashboard and during CLI browser login, so a scoped token can be created from either. The token list shows each token's scope beside its permissions. See Token Scoping for the full rules.

Using Your API Token

With the Appliku CLI:

# Set as environment variable
export APPLIKU_TOKEN=your-token-here
appliku apps list --team <team_path>

# Or save to config file
appliku login --token your-token-here

The CLI resolves tokens in this order: 1. APPLIKU_TOKEN environment variable 2. Config file at ~/.config/appliku/config.toml, written by appliku login

The Python SDK also accepts an explicit token: Appliku(token="your-token-here").

With the API directly:

curl -H "Authorization: Token your-token-here" \
  https://api.appliku.com/api/team

An API token uses the Token prefix. Bearer is for JWT access tokens, not for API tokens.

Revoking a Token

  1. Go to Account Settings > API Tokens
  2. Find the token you want to revoke
  3. Click Delete
  4. The token is immediately invalidated

Note

Revoking a token immediately breaks any integrations using it. Update your CLI configuration or CI/CD pipelines before revoking tokens that are in active use.

Notification Settings

Use Account Settings > Notifications to connect personal notification channels. Telegram deployment notifications are configured here because they are attached to your user account, not to a single team.

After connecting Telegram, choose whether to receive deployment notifications for all teams, selected teams, or no teams while keeping the bot connected. You may also see a dismissible banner on application overview pages that links directly to this Notifications tab.

Deleting Your Account

You can delete your own account from Account Settings > Delete Account. Deletion is not immediate: it is scheduled with a 24 hour recovery window so an accidental or unauthorized request can be undone.

When you confirm deletion:

  1. Your account is scheduled for deletion 24 hours in the future.
  2. A recovery email with a recovery link is sent to your email address.
  3. A persistent warning appears in Account Settings while the deletion is pending.

After the 24 hour window passes:

  • Your personal data is removed and your account is deactivated.
  • You are removed from every team you belong to.
  • Any empty team you are the sole owner of is deleted.

Cancelling or recovering a deletion

  • Cancel: While the deletion is pending, open Account Settings > Delete Account and click Cancel Deletion.
  • Recover by email: Open the recovery link from the email at any time before the scheduled deletion.
  • Support: If you did not request the deletion or need help, contact support@appliku.com.

When deletion is blocked

Account deletion is blocked when you are the sole owner of a team that still has other members or active resources (applications, databases, or servers). The dashboard shows which team is blocking the deletion. To proceed, delete those teams first or add another owner to them. Appliku does not shut down or destroy resources on your servers during team or account deletion; it only removes Appliku's records and stops managing/monitoring them.

Next Steps