First Login

Open the panel URL provided by your hosting administrator. The exact host is server-specific, but the URL pattern looks like https://your-server.example.com/en/client/login/.

The browser language is auto-detected on first visit, and the language switcher in the topbar remembers your choice across sessions.

The colour theme follows your operating system until the topbar sun/moon toggle picks one; the choice is kept by the browser. The sidebar opens collapsed to its icons at 1024 px and wider until the topbar toggle expands it; the choice is kept with your account, so it outlasts signing out and is restored at your next sign-in in any browser. Below 1024 px the sidebar becomes a drawer behind the topbar's menu button. A horizontal swipe across the page also opens it (to the right; to the left in right-to-left languages) and a swipe back closes it, as do Esc, the overlay and choosing a page; a swipe that starts on a table or another area that scrolls sideways scrolls that area instead.

Sign-in flow

1. Enter your username (or the email address registered to the account) and password. Both were sent to you by the hosting administrator after account creation.
2. If two-factor authentication (2FA) is enabled on your account, you are prompted for a 6-digit code from your authenticator app or for an email-OTP code. Enter it within ~30 seconds.
3. On success the panel loads the Dashboard. The first run may also show a one-time tour for the major sidebar items.
4. If your hosting administrator requires two-factor authentication and your account has none yet, the sign-in lands on Settings → Security with the enrolment dialog open and a notice explaining why; the other pages redirect there until the second factor is active. Signing out is still possible.

Enrolling 2FA (recommended)

Go to Settings → Security → Two-factor authentication → Enable. The enrollment dialog walks you through:

1. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, Microsoft Authenticator). If your app cannot scan, copy the displayed secret manually.
2. Verify by entering the current 6-digit code the app shows. The code must arrive within 30 seconds — clock skew on the phone can cause it to fail.
3. Save your 8 backup codes somewhere safe (each is a one-time code in XXXX-XXXX-XXXX form; once used it becomes invalid). The codes are shown only once; you will need them if you lose access to the authenticator.
4. Confirm with the "Saved!" button — 2FA is now active. Next login asks for username, password, and a 6-digit code.

Password rules

• Minimum 12 characters
• At least 3 of: lowercase letters, uppercase letters, digits, symbols
• May not be a common dictionary password
• At most 72 bytes (UTF-8): a character outside ASCII counts as more than one byte
• The password input has a live strength meter and an in-place generator (click the wand icon)

Forgot password

Click Forgot password on the login screen. Enter your registered email address. The form always says "If the account exists, an email has been sent" — it deliberately does not reveal whether your address is registered.

• The reset link is valid for 30 minutes (TTL).
• If the same address is registered on more than one hosting account, you receive one link per account and each message names the account it resets.
• The link opens the Set a new password page: enter the new password twice (at least 8 characters, at most 72 bytes, different from the current one). A link is spent on first use; an expired, used or incomplete link says so and offers the way back to the sign-in page, where you can request a fresh one. Sessions opened before the reset are ended.
• The page opens in the language the panel uses in your browser (the one you last chose there, otherwise the server's default language or your browser's); changing the language on the page keeps the link.
• Check your spam folder if the email does not arrive within ~5 minutes.
• Following the link lets you set a new password; all other sessions are logged out automatically.

Session timeout

Idle sessions log out after 30 minutes of inactivity. Active use refreshes the session window. Closing the browser tab does not log you out — you stay signed in until the idle timer fires or you click Log out in the topbar avatar menu.