Get Started

Keys and secrets

What to do when a key leaks or an employee with access leaves. Do one item at a time and check that the panel works after each.

Downloads → Reissue link. The old link stops working at once; commands copied earlier must be copied again.

License key

Licenses → the license's menu → Get a new key. Panels with the old key stop renewing: enter the new key in the panel under System → License. Nothing stops right away — the last license file stays valid for up to 7 days.

Portal account

Change the password and turn on two-factor authentication in Settings; end other sessions there.

Panel users and API keys

  • Users: change passwords, turn on two-factor authentication, remove employees who left (Users).
  • Service API keys (used by billing): issue a new key, switch your billing to it, then revoke the old one.
  • Webhook secrets: Rotate secret on the webhook — the old secret stops working at once, update your receiver right after.

Encryption key for game settings

Secret environment variables of games (passwords, tokens) are encrypted with PROFILE_ENV_ENCRYPTION_KEYS from .env. To rotate:

  1. Generate a key: openssl rand -base64 32.
  2. In .env add it as a new version next to the old one and switch the current version:
PROFILE_ENV_ENCRYPTION_KEYS=1:<old key>,2:<new key>
PROFILE_ENV_ENCRYPTION_KEY_VERSION=2
  1. docker compose up -d to restart the panel.

New records use the new key; old ones are re-encrypted the next time they are saved. Keep the old version in the list — without it the records it encrypted can't be read. Save the new .env copy; panel backups are tied to these keys.

Backup password

Change it in System → Panel backup. It applies to new backups; older archives keep their own password — keep it as long as you keep those archives.

A node is compromised

Delete the node in the panel: its certificates are revoked and the connection is dropped at once. Reinstall the machine and connect it with a new join token.

Node certificate authority

The certificate authority in certs/ is valid for 20 years and the NATS server certificate is renewed by the installer. Replacing the authority itself disconnects every node and isn't automated — if you need it, open a ticket in Support.