Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Account, SSH Keys & API Tokens

Your account settings cover three personal things: who you are on the platform, the SSH keys you push code with, and the API tokens the CLI signs in with. None of these are shared with your Organization — they belong to you.

Your profile

The platform is invitation-only: your account exists because you accepted an invitation and signed in. Your name and email come from that sign-in identity.

To check who you are signed in as from the CLI:

$ paas whoami
Ada Lovelace <ada@example.com>

The dashboard’s Account Settings page is where you manage your SSH keys.

SSH keys

An SSH public key lets you push app source over SSH — the git-push deployment flow. Keys are attached to your account, not to a single app: once added, a key can push to any app repository your account is allowed to push to. See Deploying with Git Push.

In the dashboard

  1. Open Account Settings.
  2. In the SSH Keys section, click Add Key.
  3. Give the key a name (for example, laptop) and paste the public key — the contents of a file like ~/.ssh/id_ed25519.pub, starting with ssh-ed25519 AAAA....
  4. Click Add Key.

The list shows each key’s name, fingerprint, and the date it was added. To remove a key, click Delete and confirm — that key can no longer push to your app repositories. If adding fails, check that you pasted the public key (the .pub file) in full, on one line.

With the CLI

Add a key — by default the CLI uses the first of ~/.ssh/id_ed25519.pub, id_ecdsa.pub or id_rsa.pub it finds and names it after your machine and the file; or pass a file path:

paas keys add
paas keys add ~/.ssh/work_key.pub

List your keys:

$ paas keys list
 ID                                    NAME    FINGERPRINT                                         CREATED
 809cd29b-da1e-4655-bd66-70a0d3f13e59  laptop  SHA256:Ktu6yQ3f9EcXo1VbT8mJH2yLwPq7rDgN4sAv5ZiUxYo  2026-08-12T09:15:02.114210+00:00

Remove one by its ID:

paas keys remove 809cd29b-da1e-4655-bd66-70a0d3f13e59

API tokens

When you run paas login, the CLI opens your browser, you approve the sign-in, and the CLI receives an API token for that machine. By default the token is named cli plus your machine’s hostname; pass --name to paas login to pick your own.

Tokens are managed from the CLI. List them to see every machine that holds one:

$ paas auth tokens list
 ID                                    NAME            PREFIX        ADMIN  LAST USED                         EXPIRES
 939b36d1-1ff2-4c0c-a40a-6495738b7c2d  cli ada-laptop  paas_0a1b2c3  no     2026-08-31T21:24:14.758920+00:00  -

Each row shows the token’s name, its prefix (the first characters, so you can match it to a machine without exposing the token), when it was last used, and when it expires, if it has an expiry (most rows show “-”).

Revoke a token you no longer trust — a lost laptop, an old machine:

paas auth tokens revoke 939b36d1-1ff2-4c0c-a40a-6495738b7c2d

On the machine you are using, paas logout revokes this host’s token and forgets it locally.

For scripting, paas auth token prints the current token so you can call the platform API directly — it’s also what you’d hand to an MCP client or the audit log curl examples. Treat that output like a password — never commit it or paste it into shared channels:

curl -H "Authorization: Bearer $(paas auth token)" https://api.d2o.io/api/v1/users/me

For self-hosted installations, substitute your API origin; see API Access & Automation.

For CI pipelines, use a deployment token rather than your personal API token: it can only push to one environment or app, and it belongs to the organization, not to you. Deployment tokens aren’t listed by paas auth tokens list.

Deleting your account

From Account Settings, click Delete Account. Before anything happens, the dashboard shows you the full list of what deleting your account will remove, so you can review it before confirming:

  • Every Organization you own — your personal Organization, and any team Organization you own (an Organization always has exactly one owner) — deleted entirely, including all of their projects, environments, apps, databases, buckets and their contents, secrets, and git repositories. If a team Organization you own has other members, they lose access to it — transfer ownership first if you want it to keep running instead.
  • Your SSH keys and API tokens.

Organizations and Projects you belong to but don’t own are unaffected — you’re just removed from them.

Click Delete My Account and type your account email to confirm. This cannot be undone.

Backups of the deleted databases are removed within about an hour. Depending on your installation, your sign-in identity — the account you use to sign in — may not be deleted by this step; ask whoever operates your platform installation if you want it removed too.

The API behind this is GET /api/v1/users/me/deletion-preview, which returns the same list the dashboard shows, and DELETE /api/v1/users/me, which requires a JSON body confirming your email:

curl -X DELETE -H "Authorization: Bearer $(paas auth token)" \
  -H 'Content-Type: application/json' \
  -d '{"confirm_email": "ada@example.com"}' \
  https://api.d2o.io/api/v1/users/me

A missing or mismatched email returns 400 with code: "CONFIRMATION_REQUIRED" and deletes nothing. There is no CLI command for this yet — use the dashboard or the API directly.

Next steps