Account security

Signing in

Sign in at Log in with the email address and password you signed up with. A sign-in lasts 24 hours, after which Mon asks for your password again.

After five wrong passwords in a row, the account is locked for five minutes. The sign-in page says how long is left; wait it out, or reset your password in the meantime.

Your password

A password needs:

• at least 6 characters;
• a number;
• a lowercase and an uppercase letter;
• a special character, such as ! or #.

The sign-up and reset forms tick each rule off as you type.

To change it, go to Settings › Security and choose Change password under Password. You'll need your current password, then the new one twice.

Two-step authentication

With two-step authentication on, signing in takes your password and a 6-digit code from an authenticator app on your phone - Google Authenticator, Microsoft Authenticator, 1Password or any other that reads a QR code. Someone who learns your password still can't sign in without the phone.

To turn it on, go to Settings › Security and choose Enable under Two-step authentication. Scan the QR code with the app - or, if you can't, type in the key shown beside it - then enter the code the app shows and choose Verify and enable. It's on only once that code is accepted.

From then on, after your password the sign-in page asks for the code. Each code lasts 30 seconds. Wrong codes count towards the same lockout as wrong passwords: five in a row lock the account for five minutes.

Two-step authentication applies to signing in with your email and password. If you usually sign in with Google, Microsoft or Facebook, sign in with your email and password while it's on - reset your password first if you've never set one.

To turn it off, choose Disable in the same place.

Recovery codes

When two-step authentication is turned on, Mon shows 10 recovery codes, once. Copy or download them and keep them somewhere safe, such as a password manager. If you lose your phone, choose Use a recovery code instead at sign-in and enter one; each code works once.

To get a fresh set - when you've used most of them, or think someone has seen them - choose Make new codes under Recovery codes in Settings › Security. The old codes stop working straight away.

Forgetting your password

On the sign-in page, choose Forgot password, enter your email address and choose Reset password. Mon emails you a link; open it, choose a new password and enter it twice. Didn't receive the email? sends the link again.

The link works once, for a day. After that, ask for a new one.

Access tokens

An access token lets your own code call Mon's API. Tokens come with Team and Enterprise plans.

Create one under Settings › Access Tokens with Create token:

• Name - what will use it. Each of your tokens needs a different name.
• Expires after - 30 days, 60 days, 90 days (the default), 6 months or 1 year.

The token is shown once, when it's created - copy it somewhere safe then, as Mon can't show it again. Send it with every request:

Authorization: Bearer YOUR_TOKEN

A token works for the team you're working in when you create it. To use the API for another of your teams, make it your default with Make default under Settings › Team › All teams (see Team), then create a token there.

A token carries your own access, so treat it like a password: keep it out of source code and share it with no one. Tokens are personal - other members of your team don't see yours - and you can have up to 5 at a time.

The list shows when each token expires and when it was last used. To revoke one, choose the bin icon beside it, then Revoke token. Anything still using it is refused within a minute. Revoking can't be undone; create a new token instead.

Secrets stored with monitors

Some monitors hold secrets: a password for a site behind basic authentication, custom HTTP headers, form fields sent with a request, and the keys of integrations.

Mon stores these encrypted, each with AES-256, using keys held in a key management service rather than beside the data. They're decrypted only when a check uses them, or when you edit the monitor. Once saved, a monitor's password is never sent back - not to the portal, and not through the API.