Account Settings

The account settings page gathers everything about you personally — profile, email and password, notification preferences, API keys. This page walks through each of them.

Where To Start

Pull down the avatar in the upper right corner → "Account Settings", or visit directly/account.

Personal Information

• Nickname — The name seen by other team members does not need to be your real name.
• Avatar — Upload a picture or generate it using initials (automatically hash the color according to the nickname).
• Default Language — The UI language also affects LLM's default output language suggestions.
• Default Scheduling Time Zone — It is used by default when creating a new CRON schedule; already created schedules save their own time zone.
• Dark/light mode — It follows the system by default and can be locked manually.

Email And Password

Modify Email

1. Enter a new email address → We will send a verification email to the new email address.
2. Click the confirmation link in your new email address.
3. The old mailbox will receive a notification that "your mailbox has just been modified" - if it was not you, click "Undo" immediately.

Change Password

Enter the current password, the new one and a confirmation — it takes effect immediately. A password must be 8 to 128 characters and pass a strength check. There is no "must contain letters and digits" rule; the check scores how guessable the password is, and common passwords or anything close to your email address are rejected outright. A long memorable phrase therefore passes more easily than Abc12345. Best to let a password manager generate one. Changing it signs your other devices out.

Programmatic Access to API (API Key)

For automation/CI/external scripts, it is recommended to use a dedicated API Key instead of a password to log in:

1. Account settings → "API Key" tab → click "New API Key"
2. Enter the Key name, check the required scope, and optionally set the expiration time.
3. After saving **only this time** the full Key is displayed (format dyk_<id>_<secret>) - copy immediately to your password manager or secret store
4. When calling the API: Authorization: Bearer dyk_xxxxx_yyyyy

Supported scopes:

• WEBHOOK_TRIGGER — Trigger the Webhook bound to this Key
• APPROVAL_RESPOND — Read and process manual approvals
• WORKFLOW_READ / WORKFLOW_EXECUTE — Read/Execute Workflow
• EXECUTION_READ / EXECUTION_CANCEL — Read/Cancel Execution
• ARTIFACT_READ — List and download execution artifacts

Regular users can select any of the seven scopes above as needed. CLUSTER_ADMIN is reserved for administrator service accounts in self-hosted environments. See API Key Management and the v1 Endpoint Reference for the endpoints covered by each scope.

Key can view last4/creation time/latest usage time on the same tab page and revoke it at any time. The revocation becomes invalid immediately and already issued requests are not affected.

Other Authentication Methods (in-browser/in-workflow)

• Browser login = HttpOnly Cookie + CSRF — Starting from 2026-05, the platform adopts HttpOnly Cookie authentication: dy_access / dy_refresh / dy_csrf are automatically managed by the browser, and POST/PUT/PATCH/DELETE requests automatically carry the X-CSRF-Token header. The front-end code cannot touch the token in localStorage.
• Callbacks inside workflows — zero configuration — When a running workflow needs to call the platform API (such as creating a public link through a built-in module), the engine will automatically inject the WF_API_TOKEN environment variable - a short-lived JWT, TTL 2 hours, bound to the user who triggered the workflow. The module code can directly read the environment variables, and users do not need to manually manage tokens.
• WebSocket Authentication — Use POST /api/auth/ws-ticket to get a one-time ticket with a 30-second TTL, and include ?ticket=<value> in the handshake. The front-end composables/useExecutionWebSocket.ts has been packaged.

Notification Preferences

Notifications are divided into two channels: email and site message. In addition to account security, the entire channel can be closed individually, or each category can be checked:

• Account security (necessary notice) — Password changes, login risks, verification and important account operations; sent via in-site letter and email.
• Workflow Runs — Execution failure, plan delay and operating status that requires attention.
• Collaboration and Approvals — Approval requests, team invitations, and sharing activity relevant to you.
• Subscriptions and Billing — Renewal results, payment failures, refunds, and plan status changes.
• Product Updates — New features, important improvements, and curated content.

GDPR: Data Rights

Braidrun offers a complete GDPR Phase 0 compliance stack. Account Settings → Under the "Data & Privacy" tab:

1. Data Export (Right of Access / Right of Portability · Art. 15 / 20)

Click "Export my data" and the platform will package the ZIP asynchronously. The content is generated based on the data actually owned by the account, mainly including:

• Account information, preferences, identity associations and consent records
• Workflow definition and historical versions
• Execution records, results and step-by-step events
• AI assistant session and running records
• Scheduling, Webhooks, Teams, Market Releases/Downloads and Public Sharing Records
• API Key and credential metadata; does not contain a plaintext secret that can be used directly
• Audit records related to you

You will be notified via email after generation, and the download link will be valid for 24 hours.

2. Account Deletion (Right to Be Forgotten · Art. 17)

Click "Delete My Account" to get started:

1. Confirm you are not the sole owner of any team — if you are, hand the resources over first and then dissolve that team.
2. Confirm to discard all personal workflows and credentials (it is recommended to export them first).
3. Confirm your identity as prompted on the page.
4. The account is immediately marked as DELETED and has a 7-day grace period for cancellation. After expiration, the system executes an orderly erasure process: user profile / workflow / execution / scheduling / webhook / credentials / OAuth binding / public link / API key / session / personal artifact + object storage prefix will be cleared.

3. Consent Record and Cookie Banner

View/withdraw your consent records for the four types of policies (TOS/Privacy/Cookies/Data Protection) under the "Data & Privacy" tab. Each record contains the consent time, policy version hash, and source IP. Withdrawing a certain consent will trigger the disabling of the corresponding function (for example, withdrawing the consent for cookies will clear non-essential cookies).

4. Data Retention Period

Your execution history, AI assistant sessions, login attempt records, Webhook events, etc. all have a default retention period; the system will automatically clean them up after expiration. The specific retention period can be viewed in the "Data & Privacy" tab and is also written in the "Data Retention" section of the privacy policy.

Next

• BYOK · Bring Your Own LLM Key — Connect your LLM account
• Subscriptions and Pricing — Quota/Upgrade/Downgrade