Account security

The dashboard is where your team manages payments, payouts, keys and settings. Every account signs in with an email address, a password and a second factor, and the actions that move money or open access ask for that factor again.

Two dashboards#

Dashboard	Address	Accounts
Live	https://app.nowgate.io	Live accounts, live keys and payments
Sandbox	https://sandbox-app.nowgate.io	Sandbox accounts, sandbox keys and payments

Each environment has its own dashboard and its own accounts: nothing about a sandbox account, session or key can reach live. Sign up in each one you use. The sandbox shows a "Sandbox" banner on every page.

Signing up#

Sign up with your email address, a password and your business's name. That creates your account, your business and you as its owner. Open the link in the email Nowgate sends to verify your address: the link works for 24 hours, and nothing works until the address is verified.

• In the sandbox, your business is active as soon as your email is verified.
• In live, a new business waits for Nowgate to activate it. Meanwhile you can sign in and set up your team, settings and webhooks; payments, links, API keys and payouts start once it is active, and the owner gets an email then.
• Joining someone else's business: ask its owner for an invitation.

Passwords#

• At least 12 characters, and at most 128. A long phrase is easiest to remember. There are no rules about digits or symbols, and passwords never expire.
• Refused: the 10,000 most common passwords of that length, a single repeated character, and your email address or its first part. The refusal says why.
• Stored as an argon2id hash: Nowgate never keeps your password itself.
• Changing it needs your current password and your second factor. It signs out your other sessions and sends you an email.
• Forgot it? Ask for a reset link on the sign-in page. It works once, for an hour, and setting a new password signs out every session. Your next sign-in still asks for your second factor: a reset never skips it.

Your second factor#

Every account has one, set up right after your first sign-in: the dashboard can't be used before. You can hold several at once, and should, so that losing a phone doesn't lock you out.

Factor	What it is
Authenticator app (TOTP)	A six-digit code that changes every 30 seconds. Scan the QR code, then enter a first code to confirm it. Each code works once.
Passkeys and security keys	Your device or key confirms it's you, with a fingerprint, face or PIN. Add as many as you like, and name each one.
Recovery codes	Ten codes of 16 characters, shown once with your first factor. Each works once, in place of a code. Save them somewhere safe.

On the Account page you can add and remove factors, regenerate your recovery codes, and change your password. Removing a factor is refused if it would leave you without one. Every change, and every recovery code used, sends you an email.

Lost every factor? Contact Nowgate support. Once they have confirmed it's you, they reset your second factor, you get an email, and you set up a new one at your next sign-in.

Sensitive actions ask again#

Some actions need a second factor checked in the last 5 minutes. When yours is older, the dashboard asks for a code or your passkey, then carries on:

• changing your password, adding or removing a factor, regenerating recovery codes
• creating an API key; adding or changing a webhook endpoint, or rotating its secret
• adding a payout destination; creating a payout or a batch; setting up forwarding; creating a refund; returning a stuck deposit
• turning payout approvals off
• inviting a member, changing a member's permissions, removing a member, transferring ownership, setting a cashier's PIN
• creating a till, or giving it a new pairing code

Approving payouts always needs its own check, never a recent one. See approvals.

Sessions#

• A session ends after 30 minutes without activity, and after 12 hours in any case. The dashboard then returns you to the sign-in page, and back to where you were.
• The Account page lists your active sessions with their browser, address and last activity. Sign out any of them, or every one but this.
• Sessions live in a cookie bound to the dashboard's own address, sent only with the dashboard's own requests, and unreadable to scripts. Every change also carries a token the page holds, so another site can't act in your name.
• Removed from a team, a member loses access to that business at once, on every session.

Throttles and locks#

Nowgate never says whether an address has an account: a wrong password and an unknown address get the same answer. Repeated failures slow down whoever is guessing:

What	Limit	What happens
Wrong passwords for one account	10 in 15 minutes	Password sign-in to that account is locked for 15 minutes, doubling with each lock up to 24 hours. The holder gets an email with a reset link, and a reset ends the lock.
Wrong codes in one sign-in	5	The sign-in starts again.
Wrong codes for one account	10 in an hour	The second-factor step is paused for an hour, with an email.
Failed sign-ins from one address	30 an hour	That address waits (429).
Sign-ups from one address	10 an hour	That address waits (429).
Reset links asked for	10 an hour per address, 3 an hour per account	Beyond either, no email is sent. The page says the same either way.

A lock is never announced on the sign-in page, only by email to the account's holder. If you get such an email and it wasn't you, reset your password.

What you get by email#

Nowgate emails you when your password or factors change, when a recovery code is used, when a lock starts, and when someone tries to sign up with your address. Your team gets the notices of the team guide. Links in these emails carry their token after a #, which browsers never send to servers, so it stays out of every log.