> ## Documentation Index
> Fetch the complete documentation index at: https://docs.metricanic.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account security

> Change your sign-in password and understand which credentials control account, API, AI, and landing access.

Metricanic uses separate credentials for separate jobs. Your password signs you into the tracker. API keys authorize your software. AI connections authorize an agent. The landing protection key lets your landing server validate a protected visit.

Choose the control that matches the access you want to change. Replacing a password is not a substitute for revoking a software integration's credential.

## Change your password

Open **Security**, click **Change password**, and enter **Current password**, **New password**, and **Confirm new password**. The new password must contain at least 8 characters, including an English lowercase letter, an uppercase letter, and a number. It must differ from the current password, and the confirmation must match.

Click **Update password** after the checks are satisfied. A successful change signs you out of your browser sessions, so sign in again with the new password.

For example, when replacing a password used on another service, save a new unique password in your password manager first. Complete the change, then verify that you can sign in again. Metricanic limits successful password changes to one per 10 minutes, so repeated changes within that interval are rejected.

## Use the landing protection key on your server

Under the landing protection section, **Protection key** is hidden by default. **Reveal** displays it and **Copy** copies it for your server configuration.

This workspace secret is used to verify the generated `lp_key` carried by protected landing visits. The secret and the visitor's `lp_key` are different values. Your server keeps the secret and checks the visitor's value before serving the protected page.

For a practical setup with an expected allow-or-reject result, follow [Landing protection](/tracking/landing-protection). Adding a key to a landing URL alone does not protect the page until your server validates it. Keep the workspace secret out of browser JavaScript, HTML, and public repositories.

The **Security** page provides reveal and copy controls. It does not provide a self-service rotation button for this key.

## Remove the access you no longer need

| Access to remove                                  | Where to act                           | Result                                                |
| ------------------------------------------------- | -------------------------------------- | ----------------------------------------------------- |
| A software integration's public API credential    | **API keys → Revoke**                  | Requests using that key stop authenticating           |
| An AI agent connection                            | **AI Agents → Archive AI agent**       | That connection loses read-only workspace access      |
| A Google Ads conversion destination               | **Integrations → Archive integration** | Conversions stop being sent through that connection   |
| Existing browser sign-ins after a password change | **Security → Update password**         | Successful password change signs out browser sessions |

If a public API token was exposed, revoke that specific key and issue a replacement for the affected application. If you are doing planned maintenance with no exposure, the overlapping-key workflow in [API keys](/account/api-keys) avoids interrupting the application during replacement.