Security
SSH keys, API keys, SSL certificates, and access control.
Security tools
- SSH keys: for secure server access. Guide
- API keys: for tools and MCP clients. Guide
- SSL certificates: for custom domains.
- Roles and permissions: to limit organization member access. Guide
SSL certificates
- Default project domains use the Lexoya certificate.
- For a custom domain, either enable SSL through your DNS provider or upload your own certificate from the Certificates section.
- If the domain certificate is invalid, the domain shows Invalid SSL.
See Connecting a domain for details.
Security notes
- Never upload a private SSH key to the panel.
- API keys have full access to your account; treat them like passwords.
- Use a separate API key for each tool and revoke unused keys.
- Limit organization members with custom roles.