# Sessions, API keys and SSH keys

## Sessions: where you're logged in

**Account → Sessions** lists every browser and device currently signed in to
your account, with its IP address, browser and when it was last used. Your
current one is marked under **This Device?**.

[![The Sessions page](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/scaled-1680-/acct-sessions.png)](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/acct-sessions.png)

- Don't recognise one? Click **⋯ → Remove** on it.
- **Log Out Others** signs out every device except the one you're using. Do this after changing your password, or if you've logged in on a shared computer.

<p class="callout warning">See a session you don't recognise? <strong>Change your password</strong>, click <strong>Log Out Others</strong>, and turn on <a href="https://knowledgebase.suhosting.net/books/account/page/two-factor-authentication-and-security-keys">two-factor authentication</a>.</p>

## API keys: letting apps control your server

An **API key** lets a script, bot or app (for example a Discord bot that
restarts your server) use the panel on your behalf. Most people never need one.

1. Go to **Account → API Keys** and click **Create**.
2. Give it a **Name**, and optionally an **Expires** date.
3. Under **Server Permissions**, tick **only** what the app needs, e.g. just power controls.
4. Optionally restrict **Allowed IPs** to the address the app runs from.
5. Click **Save**.

[![Creating an API key](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/scaled-1680-/acct-apikey-create.png)](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/acct-apikey-create.png)

<p class="callout danger"><strong>The key is shown only once.</strong> Copy it straight away. Anyone with the key can do whatever you allowed it to, so treat it like a password and never share it publicly.</p>

From a key's **⋯** menu you can **Disable** it, **Recreate** it (which makes a new key and stops the old
one working), or **Remove** it. The **API Documentation** button explains how
apps use the key.

## SSH keys: logging in to SFTP without a password

An **SSH key** lets your SFTP program log in without typing your password.

1. Go to **Account → SSH Keys** and click **Create**.
2. Give it a name and paste your **public** key (the `.pub` file), or click **Upload Key File**.
3. Point your SFTP program at the matching **private** key.

Step-by-step for WinSCP and FileZilla: [Connecting to your server with SFTP](https://knowledgebase.suhosting.net/books/game-panel/page/connecting-to-your-server-with-sftp).