Skip to content
NewSee how

Secure your account: password, roles & API key scopes

The real security controls: change your password with email-OTP verification, apply least-privilege roles, scope API keys narrowly, and suspend or remove members.

Tutorials
Team & Workspace
min read
5 min
steps
7 · Intermediate

  1. What you can actually control

    Four real controls exist: your password (email-OTP verified), who has what access (roles), how far API keys reach (scopes), and cutting off a member (suspend/remove). Setting expectations honestly up front avoids relying on controls the app doesn't have.

  2. Change your password (Settings → Security)

    Open Change Password, click Send Verification Code, enter the 6-digit code emailed to your account address, then set a new password (minimum 8 characters, confirmed). No code, no change.

    Change your password (Settings → Security)

  3. Apply least-privilege roles

    Assign members the narrowest role that lets them do their job. Owners are protected — they can't be suspended or removed from the member menu. See the permission-groups-and-roles tutorial for the full role setup.

  4. Scope API keys narrowly

    When creating a Developer API key, grant only the scopes it needs — for example contacts:read for a read-only export — instead of the full-access * scope. See the create-developer-api-keys tutorial for the walkthrough.

  5. Rotate or revoke keys

    API key management (admin/owner only) lets you revoke a key the moment it's exposed. Prefer several narrow keys you can revoke individually over one all-powerful key.

  6. Suspend or remove a member

    In Team, open a member's menu and choose Suspend (temporarily cut access, reversible via Unsuspend) or Remove (immediately revokes access; they can be re-invited later).

  7. A quick hardening checklist

    Strong password set via OTP, every member on least-privilege, API keys scoped instead of *, and suspend/remove anyone who leaves.

Pro tips

  • One API key per integration

    Create one key per integration with only the scopes it needs: when one leaks you revoke that key without breaking the others.

  • Avoid full-access keys for read-only jobs

    Never hand out a * (full-access) API key for a read-only job; contacts:read or campaigns:read is usually all a script needs.

  • Suspend before you remove

    If you're unsure, suspend first: it's instantly reversible. Removal means re-inviting the person later.

  • Guard your account email

    Password changes require a code emailed to your account address: keep access to that inbox, or you can't rotate your password.

Frequently asked questions

Does FirstSales support 2FA / MFA?

Not currently. Your account controls are an email-OTP-verified password change, least-privilege roles, scoped API keys, and member suspend/remove. Use a strong, unique password and tight roles.

How do I change my password?

Settings → Security → Change Password → get a 6-digit code by email → verify → set a new password (minimum 8 characters).

Can I log out other devices or see active sessions?

There's no session-management screen today. To cut off a person's access, suspend or remove them from the team.

How do I limit what an API key can do?

Pick specific scopes when you create it (read/write per resource). Avoid the * full-access scope unless you truly need it. Managing keys is admin/owner-only.

What's the difference between suspending and removing a member?

Suspend temporarily blocks access and is reversible (Unsuspend). Remove immediately revokes access; the person can be re-invited later.

Can a regular admin delete the owner?

No — the owner is protected; the suspend/remove menu doesn't appear for owners (or for yourself).

Team & Workspace

Outreach that keeps going after you log off.Leads, emails, follow-ups and replies, handled.

Connect unlimited mailboxes and let AI agents find leads, write each email and follow up. Or send your own templates in manual mode. From $29/mo.

Start your $1 trial See pricing

$1 for 3 days · Cancel anytime · No contract

Install with AI

Your coding agent sets up the FirstSales CLI and skills for you.

Prompt for Claude Code

I'm setting up FirstSales (https://firstsales.io), an AI outbound sales platform: campaigns, contacts, a reply inbox, deliverability and lead signals. Help me get my workspace sending real, good emails end to end, from Claude Code.

Read these first so you know how FirstSales works:
- Developer docs and API: https://developer.firstsales.io
- CLI: https://www.npmjs.com/package/@firstsales.io/cli
- Skills for coding agents: https://github.com/firstsalesio/firstsales-skills (read README.md and GUIDE.md)

Setup
1. Install the CLI: npm install -g @firstsales.io/cli
2. Install the FirstSales skills:
   claude plugin marketplace add firstsalesio/firstsales-skills
   claude plugin install firstsales@firstsales
3. Ask me if I already have a FirstSales account. If not, send me to https://app.firstsales.io to sign up.
4. Ask me to create an API key under Settings → API → API Keys, with only the scopes we need.
   Never ask me to paste the key into this chat. Tell me to run this in my own terminal, so the key stays hidden:
   read -rs FS_KEY && firstsales auth login --api-key "$FS_KEY"; unset FS_KEY
5. Run `firstsales whoami` and tell me which workspace and organisation we are connected to.

Then ask me about my business: what I sell, who I sell to (roles, company size, countries), my best customers, and what I use today for outbound (tools, lists, mailboxes). Walk me through:
1. Teaching FirstSales my business: website, offer, proof points and case studies in the knowledge base, so the AI writes like someone who knows the product.
2. Connecting my sending mailboxes and checking my sending domain: SPF, DKIM, DMARC and warm-up. If anything is unhealthy, tell me the exact DNS record to add.
3. Bringing in contacts: import my CSV or CRM export into a clean list, remove duplicates and bad emails, and block domains I must never email (customers, competitors, my own).
4. Building my first campaign: the right list, senders, steps and timing. Write the sequence with me, show me the drafts, and do not launch until I say yes.
5. Setting up Signals if it fits: find people engaging with LinkedIn posts about topics my buyers care about, and turn them into leads.
6. Inviting my team and giving each person the right access.

Once campaigns run, show me how to work the reply inbox from here: which replies need an answer, draft responses in my voice, and move good conversations into deals. If I use Cal.com, connect it so follow-ups can offer my booking link (not the first email).

Throughout, as you learn about my business, proactively suggest and help create:
- Reply templates for the questions and objections my prospects are likely to raise, based on my product, site and codebase if you can see them.
- Campaign ideas and segments worth testing, with the reason for each.

Safety rules:
- Show every change as a dry run (--dry-run) first and wait for my yes. Never send emails, launch campaigns or delete anything without my yes.
- Tell me before anything that spends credits, and how many.

Be opinionated. If the docs give a sensible default, just use it. Don't make me choose between five options.
Developer docs ↗npm: @firstsales.io/cli ↗GitHub: firstsales-skills ↗