Account security

Everything on this page is under Settings → Security, Settings → API Keys and Settings → Account.

Password

OKStatus never stores your password: sign-in runs on Keycloak, hosted in France.

To change it, use Send reset link on the Security page — a secure link is emailed to your address and lets you set a new one. If you sign in through Google, GitHub, GitLab or your company’s SSO, there is no OKStatus password to change; the page tells you which provider owns your account instead.

Two-factor authentication (2FA)

Available on every plan. Add a time-based one-time code from an authenticator app on top of your password:

1. Go to Settings → Security.
2. Click Set up 2FA — you’re taken to the identity provider’s enrolment screen.
3. Scan the QR code with your authenticator and confirm.

The page shows 2FA enabled once done, and Add another device lets you enrol a second authenticator. The secret lives on the identity provider; nothing is stored on the OKStatus side.

Requiring 2FA for the whole organization

On Enterprise, the Security page has an extra switch: All members must use 2FA. Members without an authenticator are redirected to the enrolment screen on their next request. Organizations that require SSO are exempt — the identity provider enforces MFA for them.

API keys

API keys authenticate the public REST API and the Terraform provider. They are available on the Max plan and above.

1. Go to Settings → API Keys.
2. Give the key a name (e.g. “CI/CD pipeline”) and, optionally, an expiry date — leave it empty for a key that never expires.
3. Click Generate new key and copy it immediately: the oks_live_… value is shown once and never again.

The list shows each key’s name, masked value, creation date, last use, expiry and status. You can Rotate a key — which issues a new value for the same entry — or Revoke it outright; both take effect immediately.

Keys with an expiry date send a reminder email to the organization’s owner at 30, 14 and 7 days before they expire, once per stage.

Tip

Give each consumer its own key — a CI pipeline, a Terraform run, a script. Then revoking one never takes down the others, and the “last used” column tells you which key is actually still in service.

Your data (GDPR)

Under Settings → Account:

• Export my data builds a ZIP archive of everything tied to your organization — monitors, incidents, checks, alerts — and starts the download. A backup link is emailed to you as well; both expire after 48 hours.
• Delete my account is irreversible. It permanently removes the organization and all its data (monitors, incidents, status pages), cancels any subscription, and deletes your identity-provider account. You must type the organization name to confirm, and only the owner can do it.

How OKStatus protects the data you store

• Secrets are encrypted at rest with AES-256-GCM under a key that is not stored with the data: monitor credentials (HTTP basic auth, database user and password, LLM API keys), alert-channel tokens and webhook secrets, and API keys. They are masked as *** in the API, in exports and in the audit log, and scrubbed from error messages.
• TLS 1.2+ on every public host, with HSTS.
• Roles (owner, admin, member, viewer) are enforced server-side, not just in the interface — see Team & roles.
• Everything that changes is written to the audit log.

The full picture, including hosting, sub-processors and vulnerability disclosure, is on the Trust center.