Manage client security and login sessions
Confirm the correct client before using **Security** or **Login Sessions**. Follow your organization’s ownership-verification process before helping someone regain access; a request containing an email address alone does not prove ownership.
Password and authentication
1. Open **Security > Change password**.
2. Enter **New password** and **Confirm password** using 8–50 characters with uppercase, lowercase, a number, and a symbol.
3. Select **Change password** and verify the saved result.
4. Use your approved secure process to help the client sign in. Do not place their password in notes or support chat.
5. Use **Reset 2FA** only for a verified recovery request. Its confirmation removes the existing authenticator, and the client may need to configure security again.
Allowed countries and Telegram
Review **Allowed countries**, choose the intended selections, and save. Do not broaden access merely to bypass an unexplained sign-in problem. **Reset Telegram** is a separate account action: the client must connect Telegram again. It does not change their password or revoke login sessions.
Review and revoke sessions
Open **Login Sessions**, refresh, and review Login Time, Status, Source, Device, Location, and Expiry / Revocation. Use **Sign out this session** for an eligible active session, or **Sign out all devices** when intended, then confirm Sign out. Revoked sessions stay in history. Some legacy rows have no individual sign-out action.
If controls are read-only, the role may lack security or session-management access. Recheck the current state after an uncertain reset rather than repeating it immediately.