Account security
Secure your Qubeforms account and form data. Protect sign-in access, manage teammate permissions, store API credentials safely, and rotate exposed form read keys.
1. Protect your sign-in
Use your Qubeforms billing account credentials to sign in to Account. Use a unique password and protect the mailbox that receives password reset messages. Choose Profile and Reset password, or Forgot password? on the sign-in screen, to start the secure email reset process. Sign out when you finish on a shared device.
2. Give teammates their own access
On Pro and Business, the owner can add existing Qubeforms customers through the form’s team settings. Viewer can read and export; Triage can also organize submissions, assign work, and add private notes. Neither role manages form settings or read keys. Choose the least access needed and remove membership when it is no longer needed. See Team-ready inbox for the complete setup.
3. Keep credentials separate
The cf_pk_ public key belongs in your website form. A cf_read_ key reads private records for one form and belongs only on a trusted server. Draft tokens authorize changes to a visitor’s draft; keep them out of URLs, analytics, and logs. Webhook signing secrets belong in the receiving server. Dashboard passwords and operator management credentials are not substitutes for these keys.
4. Respond to an exposed read key
As the owner, open Settings → API & routing → Read API and select Rotate read key. Copy the replacement immediately; it is shown once. Rotation revokes all older read keys for that form immediately. Update each server integration and confirm a read request succeeds. Removing a teammate does not rotate a key they may have copied. See API authentication for a request example.
5. Review account access after an incident
Reset a compromised password, review profile details and team membership, and inspect recipient addresses, webhook destinations, and form settings for unexpected changes. Rotate any exposed integration secrets. Keep exported data and signed attachment links private too: a valid download link grants access to its file. Contact support through the site if you cannot regain access; never send passwords or reset tokens.
Public form keys can appear in browser code. Read keys, management credentials, and webhook signing secrets must stay on the server.