Managing your credentials

Your credentials are how DotID confirms you are who you say you are. This page covers passwords, multi-factor authentication, and active sessions. Programmatic credentials belong to service users or workload identities, not to a human Profile.

Passwords

Change your password through PassPort:

  1. Visit https://auth.flexgalaxy.ai/console and sign in normally.

  2. Open the user menu (top right), choose Profile, then open Security.

  3. Click Change password, enter your current password, then your new password twice.

Root-user and platform-admin rules are fixed by the platform. An Organization administrator controls the workforce policy for locally managed workforce users. Externally managed workforce users change passwords with their identity provider. Profile shows the effective owner and rules.

Tip

A passphrase of four or five unrelated words is both easier to remember and stronger than a short password with substitutions. Length matters more than complexity.

Multi-factor authentication (MFA)

MFA is mandatory for Account root users and platform administrators. For locally managed workforce users, the Organization authentication policy decides whether MFA is disabled, optional, or required and which methods are allowed. External identity providers own MFA for federated workforce users.

To enroll a new factor:

  1. Sign in to https://console.flexgalaxy.ai/startpoint.

  2. Open Profile → Security → Multi-factor authentication.

  3. Click Add factor and follow the prompts for the factor type you want to register.

The recommended setup is one hardware security key as your primary factor and an authenticator-app TOTP as a backup. See MFA setup for the detailed enrollment walkthrough, supported hardware, and FAQ.

Programmatic access

Human Profiles do not create long-lived access keys. Browser sessions stay in the web console and are never stored as CLI credentials. Workforce users who need tenant CLI/API access use temporary STS credentials (ASIA access-key id, secret, and session token). Automation uses an Account-owned service user with AK/SK, or a workload identity for short-lived CI/runtime tokens. Platform administrators operate only through the admin-console web app.

Signing out of all sessions

If you suspect your credentials have been used by someone else — or you just want to log out of every browser and tool you might have left signed in — DotID lets you end every active session at once.

  1. Sign in to https://console.flexgalaxy.ai/startpoint.

  2. Open Profile → Sessions.

  3. Revoke selected sessions or choose Revoke all other sessions. Service-user keys and workload tokens are separate Account credentials and are not changed by this action.

After signing out everywhere, change your password as well. If you cannot sign in to perform either action, see account recovery.

See also