Profile
The profile page is where the currently logged-in user manages their own account (enter via the avatar at the top right) — a different perspective from User Management, where administrators handle other people's accounts. Both the admin panel and the merchant panel carry the same profile page with identical features.
Sensitive operations (changing the password, binding / unbinding email, managing passkeys) all require the login password first, preventing tampering through a borrowed session.
Basic Settings
Edit your name and gender; the login account is read-only. After saving a new name, the top-bar display updates accordingly.
Change Password
- Old password + new password + confirmation; password strength rules are prompted dynamically per the platform password policy;
- For accounts managed under a rotation period, an expiry reminder shows at the top of the page (days remaining / expired); expired accounts are forced to change the password before continuing;
- After a successful change, update your password manager as well; for a forgotten password use "Forgot Password" on the login page (recovery by email verification code; an email must be bound first).
Two-Factor Authentication (2FA)
Once the platform enables 2FA, you can bind an authenticator (Google Authenticator or other TOTP apps):
- Scan to bind: scan the QR code with your authenticator (or enter the key manually);
- Enter the dynamic code to confirm: verify a 6-digit dynamic code to finish binding;
- Save backup codes: one-time emergency codes (copy / download available); each works only once — you must check "I have saved them securely" to complete the wizard.
Once bound, you can regenerate backup codes (all old ones are invalidated) or turn off 2FA (confirmed with a dynamic code or a backup code). Login will then require the dynamic code.
Email Binding
- Bind / rebind: enter the login password and the new email → receive a verification code → confirm to finish;
- Unbind: password + a verification code sent to the current email;
- A verified email is used for password recovery and security notices — think it through before unbinding: without a bound email, email recovery is no longer possible.
Passkeys
Log in with device biometrics / face / PIN, no password typing:
- Add: password confirmation → the system invokes the device's biometric verification → name the device;
- The list shows each key's name, whether it is multi-device synced (keys synced by platforms such as iCloud Keychain survive device changes; "this device only" keys die with the device), plus creation and last-used time;
- Rename and delete are supported (delete requires password confirmation);
- Adding is unavailable when the browser does not support passkeys or the page is not HTTPS (local
localhostexcepted), but already-bound keys can still be managed; the platform must enable the feature in System Security Configuration.
Third-Party Account Binding
Bind third-party platform accounts (WeCom, DingTalk, Feishu, GitHub and other platforms appear per what is enabled):
- Bind: click the platform's bind button → complete OAuth authorization in the popup → filled back automatically;
- Unbind: confirm to detach (after unbinding, that platform account can no longer sign in to this system).
Which platforms are bindable is decided by the administrator's Third-Party Platform Login configuration.
Related Links
- System Security Configuration: platform switches for the password policy / 2FA / passkeys
- User Management: administrators handling accounts (password reset, banning)