Game Panel Account: 2FA, API and SSH Keys

Your game panel account is separate from MyNobull, even though you can sign in to it with your billing credentials. It has its own settings page with four things worth setting up in the first week: two-factor authentication, a password of its own, SSH keys for SFTP, and API keys if you automate anything. Open the panel as described in Access Your Game Server Panel, then click your username or avatar in the top-right corner to reach the account pages.

Two-factor authentication#

1. Open the account overview and find the Two-Factor Authentication section.
2. Enable it. Click the enable button; the panel shows a QR code and a secret key.
3. Scan the code with your authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden all work), or type the secret key in by hand.
4. Enter the six-digit code from the app and confirm with your panel password.
5. Save the recovery codes the panel shows next. Each works once. Put them in your password manager; they are how you get in if you lose the phone.

To disable, return to the same section, enter your password, and click Disable Two-Factor Authentication. If you have lost both the device and the recovery codes, open a ticket from the email on your account.

Password and email#

The Update Password and Update Email Address forms on the account overview change the panel login itself. Sub-users you invite manage their own accounts the same way, which is the whole point of sub-users: nobody but you ever needs your credentials.

SSH keys for SFTP#

SFTP to your server can authenticate with a key instead of a password. Add your public key once and every server you can access accepts it.

1. Copy your public key from your computer (cat ~/.ssh/id_ed25519.pub). Ed25519 and ECDSA keys are accepted, as are RSA keys of at least 2048 bits; DSA is refused. No key yet? See Set Up SSH Key Authentication for generating one.
2. Open the SSH Keys page from the account menu and click Add SSH Key.
3. Name it and paste the key, then save. The panel shows the key's fingerprint so you can confirm it is the right one.
4. Connect. Point your SFTP client at the host and port from the server's Settings tab with your per-server username, and choose key authentication.

Delete a key from the same page to revoke a lost device instantly.

API keys#

The panel's client API lets scripts start and stop servers, run console commands, trigger backups, and read status, which is handy for Discord bots and deploy pipelines.

1. Open API Credentials from the account menu and click Create API Key.
2. Describe it ("discord status bot") and, ideally, restrict it to the IP addresses or CIDR ranges that will use it. Up to 25 keys per account.
3. Copy the key immediately. It is shown once. Send it as Authorization: Bearer <key> against the panel's /api/client endpoints.
4. Delete keys you stop using. Deletion invalidates them instantly.

Activity#

The account Activity page (and each server's Activity tab) logs logins, security changes, and server actions with timestamps and IP addresses. Check it if you see anything you did not do, then rotate the password, enable 2FA, and delete unknown API keys.

Cover the other logins too#

• Enable Two-Factor Authentication on MyNobull
• Two-Factor Auth on the Cloud Portal (VPS and VDS customers)