Reset a Sub-user Password

A sub-user's proxy password is the secret your tools authenticate with. Rotating it is the correct response to a leaked credential, and also a reasonable periodic habit.

This is separate from your account login password. Rotating a sub-user credential does not affect your ability to sign in, and does not affect other sub-users.

When to rotate

• The credential was pasted into something public, such as a repository or a shared document.
• A person who had access no longer should.
• You are cleaning up after a suspected compromise, as described in Account Security.
• A tool or vendor you gave the credential to no longer needs it.

How to rotate

1. Open the Users tab on a product page, or /dashboard/subusers.
2. Find the sub-user.
3. Select Reset password.
4. Confirm.

The old password stops working immediately and a new one is issued. The new credential is shown so you can copy it, and it is cached only briefly, so copy it during that session rather than expecting to come back for it later.

What breaks

Every tool, script and saved connection string using the old password stops authenticating. That is the point, but it means the rotation is not finished until the consumers are updated.

Work through them in this order, so you are never fully cut off:

1. Rotate the credential on the sub-user.
2. Copy the new password while it is displayed.
3. Update your primary jobs first, and confirm one works.
4. Update secondary tools, saved integrations and any stored exports.
5. Delete old exports that contain the previous password. See Proxy Formats and Exports.

Step 4 is the one people forget. A CSV exported last month still holds the old credential and is now a stale secret sitting in a downloads folder.

If a tool still fails afterwards

• Whitespace. Copying a password can pick up a trailing space. Check the field.
• The wrong sub-user. Confirm which username the failing tool is sending.
• A cached credential. Some tools cache credentials for the session. Restart the tool.
• A second copy of the config. A deployment may hold an environment variable that was not updated.

Related

• Sub-users
• Account security
• Proxy formats and exports