> For the complete documentation index, see [llms.txt](https://infinitode-docs.gitbook.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infinitode-docs.gitbook.io/documentation/account-security-billing.md).

# Account, security & billing

How your Infinitode account works: signing in and verifying your email, authenticator-app MFA, devices and sessions, your API key and balance, activity history, plans, call packs, refunds and support.

Your account holds everything: your API key, your call balance, security settings, payments and support. This page covers how to sign in, how to keep the account secure, and how plans and calls are billed.

{% hint style="info" %}
Balances, call activity and signed-in devices are visible only after signing in, on your [account page](https://infinitode.netlify.app/auth/account/). They aren't available through an API endpoint.
{% endhint %}

## :door: Signing in

You can sign in either way:

* **Email and password** — create an account with your name, email address and a password.
* **Google** — sign up or sign in with your Google account.

Accounts created with an email address receive a **verification link**. After signing up, a confirmation screen stays with you so you can **resend** that email, and you can open your dashboard from the same screen.

**Forgot your password?** Use [password recovery](https://infinitode.netlify.app/auth/forgot-password) from the sign-in page, enter your account email, and follow the link in the reset email. Password reset applies to email sign-in; Google sign-in uses Google's own credentials.

### What email verification unlocks

Verification is a security gate. Until your email address is verified:

* your account page won't reveal your **API keys**;
* you can't **buy a Business subscription or a call pack**;
* you can't **enrol an authenticator app**;
* you can't **reset an API key**.

Verify your email first, and the rest of the account page becomes available.

## :iphone: Authenticator-app MFA (optional)

Two-factor authentication with a **TOTP authenticator app** — Google Authenticator, Authy, 1Password and similar — is optional, free, and handled by Firebase Authentication. You can enrol or remove a factor from your account page.

**To turn it on:** open your account page and start authenticator setup. Scan the **QR code** with your app, or enter the **manual key** if you're setting it up on a device that can't scan. Confirm the setup with the six-digit code your app shows.

**Once it's on:** sign-in asks for the current **six-digit authenticator code** after your password, and the same challenge applies when you sign in with **Google**.

**To turn it off:** remove the factor from your account page.

{% hint style="warning" %}
We don't offer **SMS codes** or **recovery codes**, so an authenticator app is the only second factor. Keep the app — or the manual key — somewhere you can reach.
{% endhint %}

## :desktop: Devices and sessions

Your account page lists the **devices and sessions** signed into your account, with a **device label** you can set for each one so your own devices are easy to tell apart. From there you can:

* review the devices signed in and when each session was last active;
* **remotely revoke** another session — useful if you left a machine signed in or don't recognise a device;
* **sign out** of the current session.

Inactive sessions expire automatically after **90 days**.

{% hint style="info" %}
Sign-in and support forms are protected by **Cloudflare Turnstile**, a bot check that is verified on our servers before the request is processed. If you see a brief "verifying" step when signing in, that's Turnstile — not a password check.
{% endhint %}

## :key: API key, resets and balances

Every account has one key — the **standard API key** — with a single call balance:

| Key              | Prefix | Used for                                                                                     |
| ---------------- | ------ | -------------------------------------------------------------------------------------------- |
| Standard API key | `INF-` | Every call to any endpoint, spending your monthly allowance and then any calls you've bought |

Browser calls to our APIs are supported: every endpoint allows cross-origin requests. Keep your standard key out of public front-end code anyway, because anyone who opens the page can copy it and spend your calls. While you're testing, use the [API playground](/documentation/api-documentation/api-playground.md) — its mock mode needs no key and returns dummy data in the real response shape — and call the API from your own server or serverless function in production. See [Keeping your API key safe](/documentation/api-documentation/keeping-your-api-key-safe.md).

**Replacing a key.** Your key has a **Reset** button on your account page. A reset requires a **verified email address** and a **recent sign-in**, and the key can be reset up to **three times in a rolling seven-day window**. A replaced key stops working **immediately**: from the moment you press **Reset**, requests using the old key return `401` with `"Invalid API key."`, so update your deployment first.

## :bar\_chart: Activity history

Your account page also keeps **API activity history** for the last **30 days**:

* filter the history by **time** and navigate it with the **chart** on the page;
* **export** the results as **CSV or JSON**;
* up to **5,000 entries** are returned per query — narrow the time filter for busy accounts.

Entries are metadata only. Depending on the call, an entry may show the endpoint and method, the **final three characters of the key** used and whether that key was **active** at the time, the call's **result category**, an approximate **country and city**, and an **origin or referrer**. The history does **not** store the full API key or your raw IP address, and it never stores your request parameters or the API's response body.

A key reset doesn't erase history: calls made with an old key stay listed for the remainder of the 30-day window, which is how you identify what a leaked key was used for.

## :moneybag: Plans and allowances

Prices are in **US dollars**, and checkout is handled by **PayPal**.

| Plan       | Price        | API calls / month |
| ---------- | ------------ | ----------------- |
| Free       | $0           | 250               |
| Business   | $9 / month   | 25,000            |
| Enterprise | Custom quote | 250,000+          |

* **Free** allowances reset on the **1st of each month**, and there is no subscription charge.
* **Business** is a **monthly PayPal subscription**. Its allowance refills only after a successful payment, so unused monthly calls don't roll over.
* **Enterprise** is **contact-only**: the volumes above are indicative starting points for a written quote, not an online offer.

### How Business starts, renews and ends

1. **Start.** Business begins only after you explicitly select the plan, approve the subscription with PayPal, and PayPal confirms the first payment. Selecting the plan in your account, or visiting the pricing page, doesn't charge you.
2. **Renew.** PayPal bills the saved payment method monthly on the subscription's billing date, and the allowance is replenished after each confirmed payment. While a payment is unpaid or suspended, paid features can be unavailable until it succeeds or the subscription ends.
3. **Cancel.** Cancel any time from your account or from PayPal. Cancelling stops future renewals, isn't a refund for the period you've already paid for, and doesn't remove bought pack calls — Business access continues through the end of the paid period, then the account returns to the Free allowance. Your account shows the access-end date.

There is **no pay-per-call overage charge**. When your monthly allowance and your bought calls are both used up, the API returns `401` with `"No remaining API calls."` until your allowance resets, you upgrade, or you buy a pack.

## :gift: Call packs (calls that never expire)

Top-up packs are **one-time PayPal payments** that work on **any plan**, including Free. Bought calls never expire, they're used only after your monthly allowance runs out, and they don't start a subscription.

| Pack    | Price | API calls |
| ------- | ----- | --------- |
| Boost   | $5    | 10,000    |
| Builder | $15   | 35,000    |
| Scale   | $40   | 100,000   |

Bought calls sit in the same balance as your monthly allowance and are spent the same way: monthly calls first, then bought ones.

## :arrows\_counterclockwise: Refunds

* **Call packs** can be refunded within **14 days** of the payment being confirmed, and only if the pack is **unused** — meaning your bought-call balance still covers the full quantity of calls that pack included. Monthly plan allowances don't count towards that balance. If the refund is approved, the pack's calls are removed from your balance and the payment is returned through PayPal. Calls already spent can't be refunded.
* **Business subscriptions** are **not refundable**, in whole or in part, except where applicable law requires otherwise. Cancelling stops the next renewal but isn't a refund for the current period.

Request pack refunds from the [pack refund form](https://infinitode.netlify.app/forms/billing-refund/) while signed in. The full conditions are in the [Refund Policy](https://infinitode.netlify.app/legal/refund-policy/) and the [Subscription Terms](https://infinitode.netlify.app/legal/subscription-terms/).

## :speech\_balloon: Support

Support has a form for each kind of request, so it reaches the right place:

| Question about                                                  | Form                                                                            |
| --------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| A call-pack refund                                              | [Pack refund form](https://infinitode.netlify.app/forms/billing-refund/)        |
| A PayPal payment, subscription, cancellation or access-end date | [Billing question form](https://infinitode.netlify.app/forms/billing-question/) |
| Sign-in, key setup or reset, usage meters, call history         | [Account and API-key help](https://infinitode.netlify.app/forms/account-help/)  |
| A bug in an app, experiment, API endpoint or the website        | [Bug report form](https://infinitode.netlify.app/forms/bug-report/)             |
| A security concern or suspicious activity                       | [Incident report form](https://infinitode.netlify.app/forms/report-activity/)   |
| Enterprise enquiries, or anything else                          | [Contact form](https://infinitode.netlify.app/forms/contact/)                   |

When you submit a form while signed in, your account and recent-purchase context is verified on our servers, so you don't have to describe your plan or your last payment. **Never include your password or a full API key in a form** — we'll never ask for them.

## :lock: How account data is protected

* Selected account fields — including your account email, first name, API tokens and plan identifiers — are **encrypted at rest** using authenticated encryption (AES-256-GCM). Plaintext is used only transiently in memory to serve an authorized request.
* **Payment details** are handled by PayPal. Infinitode doesn't receive or store full card numbers.
* **Activity history** keeps metadata only — no full API key and no raw IP address — and is deleted automatically after 30 days.
* **Session records** hold a device name you choose, a browser user-agent string, session creation and last-active times, and a hashed session identifier.
* **Turnstile** processes technical signals when you sign in or submit a support form, under Cloudflare's own privacy notice.

See the [Privacy Policy](https://infinitode.netlify.app/legal/privacy-policy/) and [Cookie Policy](https://infinitode.netlify.app/legal/cookie-policy/) for the complete detail.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://infinitode-docs.gitbook.io/documentation/account-security-billing.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.