Account security options

Home > Getting started > Set up > Account security options

Home > Set up > Account security options

This lesson covers all the tools you can use to keep your business data secure: passwords, roles and permissions, IP address verification and more.

In this lesson you'll learn:

Best practices for creating a password
The way to securely share login credentials
How to use Ontraport’s roles and permissions tools
Tips for managing API access
How to set up IP address verification

Next lesson

Return to: Set up

Comments

[Block//Author//First Name ##cap_first] [Block//Author//Last Name ##cap_first] on [Block//Date Added %F j, Y g:i a%+0d0h0m]

[Block//Comment]

Leave your comment

14-day free trial. No commitment.

Start your free trial to start growing your business with Ontraport.

Related resources

[Block//Resource Type]

[Block//Resource Name]

[Block//Resource Description ##ellipsis(166)]

Transcript

Your Ontraport account holds your contacts, your sales and your marketing, so it's worth locking down. In this lesson, you'll cover logins, multi-factor authentication, social login, protecting your forms, and keeping your API key safe. Start with the basics: don't share your login. Every user in Ontraport has their own username and password. If someone on your team needs access, add them as a user and give them a role with only the permissions their job needs. You set that up in the previous lesson. To change your password, click your profile icon, then Personal Profile, and find the Login Details section. Click the password field, enter your current password and then the new one, and click Save. Ontraport's security protocol also blocks logins over a VPN, so turn your VPN off before you sign in. As the account owner, you can act on your team's logins, too. In Manage users, select a user and choose Reset password, Log out, or Lock out. A locked-out user can be set back to Active later. The rest of your security settings live in one place. Click your profile icon, then Administration, then the Security tab. Multi-factor authentication asks for a unique code on top of your password, so a stolen password isn't enough to get in. It's always on in Ontraport. What you can change is how often you and your users are asked to confirm who you are. Choose a level under Multi-factor Authentication and click Save. Codes go to your login email, or by text to the cell phone number in your Login Details, so keep both up to date. Social login lets your team sign in with Google, Microsoft, Facebook or Apple. Sign in with Apple only works in the Ontraport iOS app. To allow it, turn on Social Login on the Security tab. Then each person connects their own account. In Personal Profile, scroll to Social Logins, click Connect next to a provider, and sign in. Click Disconnect to turn it off again. reCAPTCHA blocks spam bots and fake form submissions. First, set up a reCAPTCHA in Google Cloud. Choose Challenge, version 2, and add your domains, including any Ontraport-hosted domains you use. Google gives you a site key and a secret key. Back on the Security tab, paste both keys under reCAPTCHA and click Save. Then add the reCAPTCHA element to your forms, publish, and test. Older custom HTML forms are less secure and can leave you open to list bombing, where bots flood your forms with fake sign-ups. If you're not actively using them, turn on Disable Custom HTML Forms, and use forms on Ontraport pages instead. If you keep HTML forms on, Ontraport adds suspicious contacts to groups that start with "OP Engineering says," like Bad Contact and Suspect Email, so you can review them and clean up. Finally, your API key. It connects other software to Ontraport, and it gives access to the real data in your account. Treat it like a password. Don't share your API key or App ID with anyone who doesn't need it. Ontraport Support will never ask you for them. You manage keys under Administration, Integrations, in the Key Manager. Create a separate key for each integration, so it's easy to see which one is which. The same care applies to AI tools. If you connect one through Ontraport's MCP server, check the account number and email on the sign-in screen before you authorize. The connection can do whatever your role allows, including changing and deleting records, so in your AI tool, switch off anything it doesn't need. If you connect with an API key instead, it gets only that key's permissions. So: give everyone their own login, set how often multi-factor authentication checks in, protect your forms, and guard your API key. Next up: account manager features, so an agency or Expert can help you without ever needing your password.