# Authentication

> Source: https://parallelworks.com/docs/account-settings/authentication

# Authentication

## Managing API Keys

You can use an API key to access Parallel Works via its REST API. 

:::info Note

Please note that API keys act as an alternate means to access your account and should be treated with the same care as your login password.

:::

### Create an API Key

Navigate to your account settings (**Username** > **Account**).

![Screenshot of the user clicking Account.](/content-images/docs/account-settings/authentication/click-account.png?v=6bbca0bc)

On the next page, click **Authentication**.

![Screenshot of the user clicking the Authentication tab.](/content-images/docs/account-settings/authentication/click-auth.png?v=9d1c65b7)

Scroll to the **API keys** section.

![Screenshot of the API keys section in the Authentication tab.](/content-images/docs/account-settings/authentication/click-api-keys.png?v=df247db7)

Click **Create** and choose **API key**.

![Screenshot of the user clicking the Create button in the API keys section.](/content-images/docs/account-settings/authentication/add-api-key.png?v=3f1254d9)

Enter a **Key name** for the new API key.

If your organization permits users to select their own expiration date for API keys, use the **Expires** dropdown menu to select when your key will expire. You can choose no expiration or a date in 1, 2, 7, 14, 30, 60, or 90 days. Shorter expiration periods are more secure.

Click **Create**.

![Screenshot of the user clicking the Create button in the new API key dialog.](/content-images/docs/account-settings/authentication/click-add-key.png?v=927d6bc2)

Your new API key is displayed in a banner above the key list. You can use the copy button  to copy and save the key in a secure place. Once you refresh or navigate away from this page, you won’t be able to see the key again.

![Screenshot of the Authentication tab after creating an API key.](/content-images/docs/account-settings/authentication/new-api-key.png?v=bd842b85)

### Delete an API Key

Navigate to **Account** > **Authentication**, hover over the key's row in the **API keys** section, open its **…** menu, and click **Delete**  to remove an API key from your ACTIVATE account.

![Screenshot of the user clicking Delete in an API key's row menu.](/content-images/docs/account-settings/authentication/delete-api-key.png?v=863d7307)

A dialog box will appear with more information about deleting your key. Click **Delete API Key** to confirm the deletion. The key will be removed from your account immediately.

## Managing Tokens 

You can create a short-term token and use it to authenticate our CLI after installing locally. These tokens last 24 hours, after which you will need to re-authenticate.

### Create a Token 

Navigate to your account settings (**Username** > **Account**).

![Screenshot of the user clicking Account.](/content-images/docs/account-settings/authentication/click-account.png?v=6bbca0bc)

On the next page, click **Authentication**.

![Screenshot of the user clicking the Authentication tab.](/content-images/docs/account-settings/authentication/click-auth.png?v=9d1c65b7)

In the **API keys** section, click **Create** and choose **Token**.

![Screenshot of the user choosing Token from the Create menu.](/content-images/docs/account-settings/authentication/click-generate-token.png?v=53ceceb0)

If your organization permits users to select their own expiration date for tokens, use the **Expires** dropdown menu to select when your token will expire. You can choose from 1 hour up to 24 hours in 1-hour increments. Shorter expiration periods are more secure.

Click **Generate**.

![Screenshot of the user clicking the Generate button in the new token dialog.](/content-images/docs/account-settings/authentication/click-add-token.png?v=816a9d80)

Your new token is displayed in a banner above the key list. You can use the copy button  to copy and save the token in a secure place. Once you refresh or navigate away from this page, you won’t be able to see the token again.

![Screenshot of the Authentication tab after generating a token.](/content-images/docs/account-settings/authentication/new-token-screen.png?v=ad1f25ac)

## Managing SSH Keys 

You can add an SSH key to your ACTIVATE account, which will allow you to log in to any active cluster from any device with that SSH key on it.

### Create an SSH Key

Navigate to your account settings (**Username** > **Account**).

![Screenshot of the user clicking Account.](/content-images/docs/account-settings/authentication/click-account.png?v=6bbca0bc)

On the next page, click **Authentication**.

![Screenshot of the user clicking the Authentication tab.](/content-images/docs/account-settings/authentication/click-auth.png?v=9d1c65b7)

Scroll to the **SSH keys** section.

![Screenshot of the SSH keys section in the Authentication tab.](/content-images/docs/account-settings/authentication/click-ssh-keys.png?v=73dfb3bc)

Click **Add**.

![Screenshot of the user clicking the Add button in the SSH keys section.](/content-images/docs/account-settings/authentication/add-ssh-key.png?v=76593114)

Use the **Key name** field to give the key a unique name. Paste your public SSH key in the **Public key** field.

Click **Create**.

![Screenshot of the Authentication tab after pasting an SSH key and naming it.](/content-images/docs/account-settings/authentication/click-add-ssh.png?v=88ef3ade)

You can now log in to any active cluster. Navigate to the terminal or command line on your device and enter `ssh -i /path/to/ssh/private/key username@IPaddress`:

```shell

parallelworks@Parallels-Macbook-Air sshtest % ssh -i ./id_rsa demo@34.135.24.147
Last failed login: Thu Mar  2 09:48:20 UTC 2023 from 60.94.197.104.bc.googleusercontent.com on ssh:notty
[demo@democluster-70 ~]$

```

### Copy an SSH Key 

In **Account** > **Authentication**, hover over the key's row in the **SSH keys** section and click the clipboard icon  to copy your SSH key to your computer's clipboard.

![Screenshot of the user clicking the clipboard icon.](/content-images/docs/account-settings/authentication/click-share-key.png?v=a7fec08a)

## Managing SSH Private Keys

You can store private SSH keys on your ACTIVATE account, which the platform uses on your behalf to connect to remote resources — for example, existing clusters that require an SSH credential you already hold.

Unlike the public SSH keys described above (which let you log in *to* your clusters), private keys let ACTIVATE log in *from* the platform to a remote resource.

### Create an SSH Private Key

Navigate to your account settings (**Username** > **Account**). On the next page, click **Authentication** and scroll to the **SSH private keys** section.

Click **Add**.

Use the **Key name** field to give the key a unique name, and optionally add a **Description**. Paste your private key in the **Private key** field.

Click **Create**. The key is then listed with its description, creation date, and fingerprint.

### Delete an SSH Private Key

In **Account** > **Authentication**, hover over the key's row in the **SSH private keys** section, open its **…** menu, and click **Delete** . A dialog box will appear; click **Delete private key** to confirm.

## Managing Multi-Factor Authentication

You can add a second verification step to your account. With 2-Step Verification turned on, signing in requires a code from an authenticator app in addition to your password.

### Turn On 2-Step Verification

Navigate to your account settings (**Username** > **Account**). On the next page, click **Authentication**.

In the **Sign-in** section, the **Two-step verification** row shows whether 2-Step Verification is currently on or off. Click **Set up**.

On the **Manage MFA Settings** page, find the **Authenticator app** card and click **Use Authenticator**.

On the **Setup Authenticator App** page, use a phone app like 1Password, Authy, Google Authenticator, or Microsoft Authenticator to scan the QR code. If you can't scan the QR code, click **Can't scan the QR code?** to reveal a secret key you can enter in your app manually.

Enter the 6-digit code from your app in the **Verification code** field and click **Enable 2FA**. A dialog box with the message _MFA setup successful_ will appear.

The next time you sign in, you'll be asked for a code from your authenticator app after entering your password.

:::note Feature Preview

Security keys (WebAuthn) are also available as an MFA method through a Feature Preview. Organizations can require them with the [**Enforce Security Key MFA**](/docs/organization-admin/settings/policies) policy.

:::

### Turn Off 2-Step Verification

Navigate to **Account** > **Authentication** and click **Manage** on the **Two-step verification** row.

To remove your authenticator app, click the delete icon  on its card. A dialog box will appear; click **Remove Authenticator app** to confirm. Your authenticator will be removed immediately.

To turn off 2-Step Verification entirely, click **Turn Off**. A dialog box will appear; click **Turn off 2-Step Verification** to confirm.