Security · 28 October 2026
Your account,your alert.
When two-factor is turned off, a recovery code is used, someone is made an owner or admin, or a live API key or webhook is added, the person and the workspace's owners get an email within seconds.
The details
What changed.
Taking over an account usually starts the same way: turn off two-factor, give yourself a stronger role, add a key or a webhook. Until now only Payshen's operators were alerted. Only you know whether a change was yours, so the notice now goes to you as well.
Five events send one: two-factor turned off, a sign-in with a recovery code, someone made an owner or admin, a live API key created or rolled, and a live webhook endpoint added or its signing secret rolled. The person it is about is told, and so are the workspace's owners, so a change made from a stolen mailbox still reaches someone else. Test-mode keys and endpoints send nothing.
The email says what happened, when and from which address. It has no link on purpose: if the change was not yours, sign in yourself, sign out everywhere from Settings and check the audit log. The same notice is sent at most once in ten minutes, it cannot be turned off, and a white-label workspace receives it under its own brand.