Account Security

Your Mengi Cloud account supports several ways to sign in — passkeys, social sign-in (GitHub, Google, Microsoft, GitLab) and, for older accounts, email + password. This guide covers how each method works and how to manage the credentials on your account, including API keys.

Method	Who it’s for
Passkey	The default — new accounts are created with a passkey.
Social sign-in	Sign in with your GitHub, Google, Microsoft or GitLab account.
Email + password	Older accounts only. On your next password sign-in you’ll be asked to switch to a passkey.

You can combine methods: an account created with a passkey can also be connected to a social provider, and vice versa — handy as a backup (see recovery below).

Passkeys

A passkey lets you sign in with your fingerprint, face recognition or a security key — nothing to remember, nothing that can be phished or leaked.

Signing in with a passkey

On the sign-in page, enter your email address.
Click Sign in with passkey.
Your device prompts you to confirm — fingerprint, face or security key — and you’re in.

Adding a passkey

Go to Settings → Passkeys and click Add Passkey. Your browser walks you through registering the new passkey on the current device.

Each passkey shows whether it is synced (shared across your devices via your platform account, e.g. iCloud Keychain or a password manager) or device-bound (lives only on one device), when it was created and when it was last used. Use the pencil icon to rename a passkey — name it after the device it lives on (e.g. Work laptop, Phone) so you can tell them apart later.

Switching from a password to a passkey

Passwords are being phased out in favour of passkeys. If your account still has a password, the next time you sign in with it you’ll be taken to a one-time Set up Passkey page:

Click Register Passkey.
Confirm on your device.
Done — your password is removed from the account, and from then on you sign in with the passkey (or a connected social provider).

Removing a passkey

In Settings → Passkeys, click the delete icon next to a passkey and confirm.

You cannot delete your last passkey unless your account is also connected to a social sign-in provider — you always need at least one way to sign in.

If you lose your passkey device

A synced passkey is available on your other devices automatically — just sign in from one of them.
If your account is connected to a social provider, sign in with that instead, then add a new passkey from Settings → Passkeys and delete the old one.
Best practice: register a second passkey (e.g. on your phone as well as your laptop) or connect a social provider before you need it.
If none of the above apply, contact support to recover access.

Mengi Cloud supports sign-in with GitHub, Google, Microsoft and GitLab. Pick a provider on the sign-in or registration page and authorise Mengi Cloud — no separate credentials needed.

Connecting a provider happens automatically: sign in with a provider whose email address matches your account, and it is linked from then on.
An account is connected to one provider at a time — signing in with a different provider that uses the same email address switches the connection.
There is no manual disconnect. If you want to stop using a provider, set up a passkey as your sign-in method instead.

Email and profile

Your name can be changed at any time from your account settings.
Your email address identifies your account and can’t be changed from the dashboard. If you sign in with a social provider, the address stays in sync with that provider. To change it otherwise, contact support.
There is no password to change — accounts with a password are migrated to passkeys on their next sign-in.

API keys

API keys authenticate programmatic access — scripts, CI pipelines and tools calling the Mengi Cloud API. For how to make requests with one, see API — Getting Started. This section covers managing the keys themselves.

Creating a key

Go to Settings → API keys and click Create.
Give it a name (and optionally a description) that says where it’s used — e.g. ci-pipeline or local-dev.
Copy the key immediately — it is shown once and can’t be retrieved later. Keys start with mc_.

A key carries your account’s full permissions — anything you can do, the key can do. There are no per-key permission scopes, so treat every key like a password. Keys don’t expire by default; an expiry date can be set when creating one through the API.

Viewing your keys

Settings → API keys lists every key with its name, a short prefix (the first characters, so you can match it to the copy you stored), when it was created and when it was last used. A key that hasn’t been used in months is a good candidate for deletion.

Rotating a key

To rotate a key (periodically, or after a suspected leak):

Create a new key.
Update your scripts and pipelines to use it.
Revoke the old key.

Doing it in this order means zero downtime for whatever uses the key.

Revoking a key

Click the delete icon next to a key and confirm. The key stops working immediately and revocation cannot be undone — if you revoke the wrong one, create a new key.

Keeping keys safe

Never commit a key to version control. Use environment variables or a secret instead.
Use one key per integration — when something leaks or gets decommissioned, you can revoke just that key.
Rotate periodically, and revoke any key you no longer use.

Deleting your account

From Settings, you can request account deletion:

Delete all active clusters first — deletion can’t be requested while clusters are running.
Click Delete account and type DELETE to confirm.
Your account is deactivated and permanently deleted after 30 days.

During the 30-day grace period you can cancel the request from the same page and your account is reactivated.

Good to know

New accounts are created with a passkey — there is no password to choose, and nothing password-shaped to leak.
Register at least two ways in (a second passkey or a social provider) so a lost device never locks you out.
A synced passkey survives losing the device; a device-bound one doesn’t — check the badge in Settings → Passkeys.
API keys are as powerful as your sign-in — the last used timestamp helps you spot keys that are unused (delete them) or used when they shouldn’t be (rotate them).
Signing out only ends your browser session — it does not affect API keys or passkeys.