Back
Account & Security

Secure your account (2FA, strong passwords, tokens)

Harden your Victus account: enable two-factor authentication, use a strong unique password, and never share API keys, reseller keys, or panel tokens.

2fatwo-factorsecuritypasswordapi keytokenresellerphishing

Your Victus account can control real infrastructure — game servers, full KVM virtual machines with root access, bots, and prepaid credit. That makes it a target. A few minutes of hardening prevents almost all account takeovers. The three pillars are: enable two-factor authentication, use a strong unique password, and never share your tokens or keys.

Enable two-factor authentication (2FA)

  1. 1Log in and open your account / security settings (on the control panel this is under your Account area).
  2. 2Choose to enable two-step / two-factor authentication.
  3. 3Scan the QR code with an authenticator app such as Google Authenticator, Authy, or Aegis.
  4. 4Enter the 6-digit code the app generates to confirm and activate 2FA.
  5. 5Save the one-time recovery codes somewhere safe and offline — a password manager or printed copy.

Store your recovery codes now

If you lose your authenticator device and do not have recovery codes, regaining access requires a manual ownership check via a support ticket, which is slow. Save the codes the moment 2FA is enabled.

Use a strong, unique password

  • At least 12–16 characters — length beats complexity.
  • Unique to Victus; never reuse a password from another site.
  • Use a password manager to generate and store it (Bitwarden, 1Password, KeePassXC).
  • A passphrase of 4+ random words is both strong and memorable.

Never share tokens, keys, or codes

Victus and its staff will NEVER ask for your password, your 2FA codes, or your API/reseller keys. Anyone who does is attempting to phish you. Treat the following as secrets equivalent to a password:

  • Reseller API keys (they start with rslr_) — anyone holding one can spend your prepaid credit and provision services.
  • Panel API keys / client tokens used for automation.
  • VPS root passwords and SSH private keys.
  • Database passwords shown in the panel Databases tab.
  • One-time 2FA codes and recovery codes.
bash
# Reseller key example — treat like a password.
# Pass it via an environment variable, never hard-code or paste it in chat/screenshots.
export VICTUS_RESELLER_KEY="rslr_xxxxxxxxxxxxxxxxxxxx"
curl -H "Authorization: Bearer $VICTUS_RESELLER_KEY" \
     https://control.victuscloud.com/api/reseller/v1/...

If a key leaks, rotate it immediately

If you accidentally commit a reseller/API key to Git, paste it in a screenshot, or share it, revoke it from the panel Reseller API page and mint a new one right away. Then check your credit balance and recent activity for anything you did not do.

Spotting phishing

Always log in via the real domains: billing.victuscloud.com and control.victuscloud.com. Check the URL before entering credentials, and be suspicious of DMs offering free credits, "verification" links, or urgent account warnings.

Related in Account & Security

Create and verify your accountRegister a Victus account on the billing/store portal, verify your email, and understand which login works where across control, billing, and Drive.Reset your passwordRecover access to your Victus account when you forget your password, and reset the separate control-panel and Drive passwords.Account suspended or banned — what to doUnderstand why a Victus account or service gets suspended (unpaid credit, expired free server, or anti-abuse), and the exact steps to appeal and restore access.Change your emailUpdate the email address on your Victus account safely, keep billing and control-panel logins in sync, and re-verify the new address.Delete your accountPermanently close your Victus account — what to back up first, how to cancel services and clear invoices, and how to request deletion.