Settings has four tabs: Profile, Preferences, Notifications and Security. Nothing here changes how the API behaves — that is API keys and Plans. This page is about your account and the dashboard itself.
Profile
Your name, website, business, role, phone, country, location and timezone, alongside the date the account was created.
Your email cannot be changed here, and the page says so. It is the account's identity — what invoices and account notices go to, what support matches you on, and what a team invite has to be addressed to for you to accept it. If it needs to change, that is a support request.
Changes save on Save changes rather than on blur, so leaving the tab mid-edit discards them.
Preferences
Four settings, in two groups, plus a privacy control that is not really a preference at all.
Appearance
| Theme | Light, Dark or System |
| Date format | MM/DD/YYYY, DD/MM/YYYY or YYYY-MM-DD, applied to every date the dashboard renders |
Developer
| Preferred language | Which language code snippets default to, where a page shows them |
| API response view | Pretty-printed or raw JSON in response panels |
The language preference is the one that saves real time: the playground and the snippets on reference pages open on your choice rather than on cURL every time, so copy-paste lands in the language you are actually writing.
Response view is worth switching to raw when you are checking exact structure or whitespace — pretty-printing is a rendering, and the raw view is what your code will actually parse.
Both are saved locally rather than to your account, so they do not follow you to another browser or another machine. That is deliberate — they describe how you like to read things here, not something about the account.
Privacy manages the analytics and advertising cookies the dashboard uses. It is the same control as the consent banner, reachable after you have dismissed it — the choice defaults to off and can be reversed at any time.
Notifications
Which emails you receive, in two groups.
Usage alerts are the operational ones, and both default to on:
| Alert | Sent when |
|---|---|
| Usage warning (80%) | You have used 80% of the cycle's credits |
| Limit reached (100%) | Credits are exhausted and calls are being refused |
The 80% warning is the one worth keeping. It arrives while you still have room to act — cache something, throttle a job, or upgrade — where the 100% notice arrives after calls have already started failing.
Email notifications are the discretionary ones, and each can be turned off on its own:
| Product updates | New features, API changes and announcements |
| Partner communication | Messages from partners and integrations |
| Feedback & research | Surveys and research invitations |
| Beta features | Early access to betas and previews |
Turning all four off does not affect the usage alerts, invoices or security notices — those are account mail rather than marketing, and there is no switch for them here because an account that cannot be told its credits ran out is not a functioning account.
Both groups save together, and the Save changes button stays disabled until something actually changed, so a tab you opened and read costs nothing to leave.
Security
Sign-in method
Shows how you sign in — a password, or a linked provider such as Google or GitHub. Accounts created through a provider have no password until one is set.
Change password
Requires your current password, then the new one twice. Use something long that you do not reuse anywhere else; a password manager makes that free.
If you sign in with a provider and have no password, there is nothing to change here — your provider owns the credential.
Two-factor authentication
Adds a code from an authenticator app on top of your password.
Setup is the usual three steps: scan the QR code with your authenticator (or enter the key manually if you cannot scan), enter the six-digit code to prove it worked, then save your recovery codes.
Each code works once and they are shown only during setup. They are the way back in if you lose the device with your authenticator on it. Store them somewhere that is not that device — a password manager or a printed copy, not a note on the phone running the authenticator.
Disabling two-factor requires a code from the app or one of the recovery codes, so an attacker with only your password cannot turn it off.
Two-factor protects the dashboard, not the API. An API key authenticates on its own, which is why key hygiene — scoping, rotation, separate keys per environment — is a separate discipline from account security rather than covered by it.
Recent login activity
Successful sign-ins with their time and origin. Skim it after enabling two-factor, and again if anything about the account looks unexpected. A sign-in you do not recognise is the point at which you change the password, rotate the key, and check the audit history for what was done with the session.
Read-only workspaces
If you are viewing a teammate's workspace through the switcher, every control on this page is disabled and the header says whose account you are looking at. Settings are always personal to the account that owns them — see team roles for what a role does and does not grant.
Next
API keys covers the credentials, which is the security surface that actually faces the internet. Teams covers shared access.