> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pocketsflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account & security

> Keep your Pocketsflow account secure and your business details, verification, payouts, and API access in order.

Your Pocketsflow account is the key to your income and your customer data. This
guide covers the settings that matter and the practices that keep it safe.

## Profile & business information

Under **Settings → Account**, keep the following current — several of these
fields appear on the **invoices** your buyers receive, so accuracy is
customer-facing (see [Taxes & invoices](/payments/taxes-and-invoices)):

* **Name** and display name.
* **Contact email** — where support replies and buyer emails reply to.
* **Profile image / brand avatar**.
* **Business address** — city, state, ZIP, country.
* **Tax ID** — printed on invoices when set.
* **Subdomain** — your `{subdomain}.pocketsflow.com` storefront address.

## Sign-in & password

Pocketsflow sign-in is handled by our identity provider (Auth0). Best practices:

* Use a **strong, unique password** you don't reuse elsewhere, ideally stored in
  a password manager.
* Don't **share your login** — if you work with a team, give each person their
  own access rather than sharing one credential.
* If you suspect your details were compromised, **change your password
  immediately** and contact support.

### Two-factor authentication (2FA)

Where offered, enable 2FA from your security settings and prefer an
**authenticator app** over SMS. 2FA adds a second layer on top of your password
and is the single highest-impact thing you can do to protect your earnings.

### Devices & sessions

Periodically review logged-in sessions and any unusual activity, sign out of
devices you no longer use, and avoid logging in on shared or public computers.

## Test mode vs live mode

Your account has a **test mode** toggle. Test mode is a fully separate
environment — test orders, customers, subscriptions, discounts, and analytics
never mix with live data. Build and rehearse in test mode, then switch to live
when checkout works end-to-end. See [Payment methods → Test mode vs live
mode](/payments/payment-methods).

## Business verification & approval

Because real money moves through your account, live payouts require verification:

<Steps>
  <Step title="First real sale flags your account">
    Your first live sale marks your account as **needing business approval**
    (`required`).
  </Step>

  <Step title="Complete verification (KYC/KYB)">
    Connect and verify your payout account with our payment infrastructure — identity and, for
    companies, business verification. Your status moves to `submitted`.
  </Step>

  <Step title="Approval is closed automatically">
    When the provider marks your payout account **connected**, Pocketsflow
    auto-approves you (`approved`) and releases payouts. If it's bounced back
    (action required / disabled), your status returns to `rejected` and you'll be
    asked to resubmit.
  </Step>
</Steps>

<Warning>
  Complete verification **early**. Until it's done, live payouts are held even
  though sales still complete. See [Payouts](/payments/payouts).
</Warning>

## Payout security

* Treat **payout details** as your most sensitive setting — changes to where
  money is sent should be tightly controlled.
* The connected payout account is also what pays [affiliate](/operations/affiliates)
  and [partner](/operations/partner-program) commissions.

## API keys & integrations

If you use the API or webhooks, manage **API keys** from your settings:

* Keep keys **secret** — treat them like passwords and never commit them to
  client-side code or public repos.
* **Rotate** a key immediately if it's exposed.
* Prefer separate keys per integration so you can revoke one without breaking
  the others.

For details, see [API authentication &
security](/api-webhooks/authentication-and-security) and the [API
reference](/api-reference/introduction).

## Related topics

* [Payouts](/payments/payouts)
* [Taxes & invoices](/payments/taxes-and-invoices)
* [Refunds & disputes](/payments/refunds-and-disputes)
* [API authentication & security](/api-webhooks/authentication-and-security)
* [Contact support](/buyers/contact-support)