Skip to main content
Metricanic uses separate credentials for separate jobs. Your password signs you into the tracker. API keys authorize your software. AI connections authorize an agent. The landing protection key lets your landing server validate a protected visit. Choose the control that matches the access you want to change. Replacing a password is not a substitute for revoking a software integration’s credential.

​
Change your password

Open Security, click Change password, and enter Current password, New password, and Confirm new password. The new password must contain at least 8 characters, including an English lowercase letter, an uppercase letter, and a number. It must differ from the current password, and the confirmation must match. Click Update password after the checks are satisfied. A successful change signs you out of your browser sessions, so sign in again with the new password. For example, when replacing a password used on another service, save a new unique password in your password manager first. Complete the change, then verify that you can sign in again. Metricanic limits successful password changes to one per 10 minutes, so repeated changes within that interval are rejected.

​
Use the landing protection key on your server

Under the landing protection section, Protection key is hidden by default. Reveal displays it and Copy copies it for your server configuration. This workspace secret is used to verify the generated lp_key carried by protected landing visits. The secret and the visitor’s lp_key are different values. Your server keeps the secret and checks the visitor’s value before serving the protected page. For a practical setup with an expected allow-or-reject result, follow Landing protection. Adding a key to a landing URL alone does not protect the page until your server validates it. Keep the workspace secret out of browser JavaScript, HTML, and public repositories. The Security page provides reveal and copy controls. It does not provide a self-service rotation button for this key.

​
Remove the access you no longer need

If a public API token was exposed, revoke that specific key and issue a replacement for the affected application. If you are doing planned maintenance with no exposure, the overlapping-key workflow in API keys avoids interrupting the application during replacement.