Manage sign-in security, API keys and webhooks from one settings page

What you will have

• See who is signed in right now and force one of them out.
• Set how many sessions each role can hold at once, and how long an idle session lasts before it expires.
• Read the sign-in safeguards at the top of the page: two-factor enforcement and the shared failed-login and lockout numbers.
• Block a suspect IP address, and see how that differs from the two lists on the Geographic Access card.
• Turn on Geographic Access to restrict logins by country, and see how an IP entry can bypass it.
• Read the Recent Admin Connections list and know exactly where its rows come from.
• Issue an API key and a webhook, and see exactly what each one shows you once.

Why it works this way

Steps

1. 1

   Open Settings > Security > Access & Sessions and read the sign-in safeguards at the top.

   Require Two-Factor (MFA) defaults to Off (optional); Staff / internal accounts and Everyone are the other two choices. Max Failed Login Attempts (5 by default) and Lockout / Window Duration (1 hour by default) work as one pair: the same hour count is both the rolling window that counts failed logins and how long the automatic IP block lasts once that count is hit. Raising the number makes detection more lenient (a longer window to accumulate failures) and makes the resulting block longer at the same time; lowering it tightens detection and shortens the block together.

   

2. 2

   Scroll to Active Sessions to see who is signed in right now.

   Each row shows the user, role, IP address, device, when the session started, and when it was last active. The current session carries a you badge. Terminate signs that device out immediately - terminating your own session signs you out of the portal too. Sessions are also cleaned up automatically by the weekly Session Cleanup job (Sundays at 4 AM), regardless of what Terminate has or has not been used on.

   

3. 3

   Set Concurrent Session Limits for each role.

   A value of 0 means unlimited; the defaults cap Owner, Super Admin and Admin at 1 session, Primary Contact at 1, IT Admin at 2, and Client User & Billing at 3. When a user already at their role's cap signs in from a new device, the oldest existing session for that role is force-revoked to make room - useful for Owner or Super Admin, typically capped at 1, so a stolen session cannot silently sit alongside the legitimate one.

   

4. 4

   Set Session Timeouts and click Save Session Settings.

   Staff Inactivity Timeout (8 hours by default), Client Inactivity Timeout (24 hours) and Absolute Session Lifetime (7 days) both apply at the next session-check tick, which runs every few minutes, never retroactively. Dropping Client Inactivity Timeout a lot - to less than half its previous value - signs out every active client portal user at the next check; they see "your session expired." Consider rolling a big drop like that in during off hours, or telling client primaries first.

   Warning: A saved drop in Client Inactivity Timeout applies to every client user already signed in, not just new sign-ins, at the next check.

   

5. 5

   Open Access Control and click Block IP.

   Block IP takes an IP address or CIDR range and an optional reason. This walkthrough blocks 203.0.113.0/24, a range reserved for documentation and safe to use as an example, with the reason "KB walk - example, safe to remove."

   

6. 6

   See the new entry on the Blocked IPs list.

   Blocked Users and Blocked IPs are Access Control's own deny lists. An IP blocked here is denied outright - it has nothing to do with the Geographic Access allowlists further down the page, which do the opposite job (letting traffic through). Adding an address to one list never adds or removes it from the other; add it wherever you need that specific effect.

   

7. 7

   Scroll to Your Connection and Geographic Access Control.

   Your Connection shows the real IP address and country this session is signing in from, each with a one-click shortcut to allowlist it. Geographic Access Control restricts logins by country and is an allow list only - there is no separate block list. It stays Inactive until at least one country is added, and because it is checked on every request, not just at sign-in, turning it on immediately signs out anyone already working from a location that is not allowlisted.

   

8. 8

   Add an IPv6 range to the IP Allowlist.

   The Country Allowlist and IP Allowlist are both checked on every request, and either one is enough on its own: an entry in the IP Allowlist bypasses the country check entirely, even while Geographic Access Control itself is off. The CIDR matcher accepts IPv6 ranges the same way it accepts IPv4 - adding 2001:db8::/32, a range reserved for documentation, lists it tagged CIDR exactly like an IPv4 range would.

   

9. 9

   Open Recent Admin Connections.

   This card is collapsed by default. It lists the last 20 distinct IP addresses that have signed in from any Admin or Super Admin account in the last 30 days, sorted by recency, each geo-resolved to a country (the city is not shown). It loads once, when the page loads - it does not poll. Priya Shah, a User-role contact, never appears here even though she has an active session, because that role is not Admin or Super Admin. Clicking an address's own Add link allowlists it, for either the IP Allowlist or the Geographic bypass.

   

10. 10

    Open API Keys and start a new key.

    New Key asks for a name and at least one scope, and optionally a client organization binding or an expiry date. There is no rate-limit field here: every key is created with the same default of 1,000 requests per minute. That per-key limit is wired up in code, but it does nothing today, because Bearer-token requests never reach an API-key route - the sign-in proxy redirects any request without a session cookie to the login page first.

    

11. 11

    Create the key and copy its plaintext token.

    The token is shown exactly once, under "Save this key now - it will not be shown again"; the database stores only a hash of it from this point on, so support can never read it back to you. It is masked in this screenshot for the same reason. The list below then shows each key's name, its scopes, its org scope (MSP-wide unless bound to one client), when it was last used, and its status. External callers use a key as an Authorization: Bearer ezk_live_... header. The three KB walk - example rows are this article's own sandbox keys from successive passes, and every one of them is Revoked now.

    Note: This walkthrough revoked its own sandbox API keys straight after capturing them, and masks the one-time token in the screenshot rather than publishing it. The rows stay on the tenant, marked Revoked.

    

12. 12

    Create a webhook and copy its signing secret.

    New Webhook asks for a name, a destination URL, and which events to subscribe to; this one subscribes to ticket.created and points at https://example.com/webhook. The signing secret is shown exactly once, the same way an API key's token is, and it is masked in this screenshot for the same reason. Every matching event is then POSTed to that URL with an X-ezCyber-Signature header. After 10 consecutive delivery failures the webhook disables itself automatically, and that auto-disable is written to the audit log. Both KB walk - example rows are this article's own sandbox webhooks, and both are Disabled now.

    Note: This walkthrough disabled its own sandbox webhooks straight after capturing them, and masks the one-time signing secret in the screenshot rather than publishing it. The rows stay on the tenant, marked Disabled.

    

If it did not work

• If Save Session Settings, or the fields above it, will not save, check you are signed in as the tenant's owner email or an internal Super Admin - every field on the top card and the Sessions cards is Owner-tier, and the button does not work for anyone else.
• If Recent Admin Connections is missing entirely, no Admin or Super Admin account has signed in during the last 30 days yet - the card only renders once there is at least one row to show.
• If Terminate, Remove, or Revoke does not appear next to a row, your role does not carry the delete-tier permission that view-only accounts do not get by default.

Questions this page answers