Skip to main content
Settings opens on General. The other tabs are Team, Security, Countries, and Danger zone. /app/settings redirects to General. Changing workspace settings needs settings.write (owner and admin). Security settings are on your own user, so every role can open that tab and manage their own sign-in. Team is documented on Team, roles, and invites.

​
General

Language and region is the block customers ask about. A send can still pass language on POST /v1/otp/send to override the workspace language for that one body. Accept-Language changes error prose only, not the SMS body. The same page also has:
  • Workspace name. The name on the account.
  • OTP delivery. sms (default), whatsapp, both, or either. This is OTP only. It is not general WhatsApp messaging. Details are on OTP verification.
  • Billing country and currency. You can change the currency until the first paid top-up settles. After that it is locked. Contact support to change a locked currency. Destination prices stay in credits. Read them from GET /v1/pricing.
  • Message characters. On by default. Symbols GSM-7 cannot carry are rewritten before a transactional SMS is measured, so one symbol does not add a part. OTP bodies are untouched. Turn it off to send the body exactly as written.
  • Low balance alerts. An email when the balance is low. This does not charge a card. Auto top-up is on Billing.
  • Webhook signing secret. Shown to people with webhooks.write. Rotate it here. The old secret stops verifying immediately.
  • Account and connected accounts. Your own sign-in details.

​
Security

Security is a second step at sign-in, after the password. Owner and finance must turn it on. They have 14 days from when the requirement starts. The page shows the date. After the 14 days, sign-in stops on the enrollment screen until an authenticator app or a passkey is set up. Admin, member, and viewer are not required to enroll. They can still add a method.

​
Authenticator app (TOTP)

  1. Choose Set up an authenticator app.
  2. Scan the QR code, type the setup key, or open the link on this device. The issuer name in the app is Robase.
  3. Enter the 6 digit code the app shows.
To remove it, enter a current code. Removing the app does not remove passkeys you added separately. At sign-in, enter the current 6 digit code. If you do not have the device, use a recovery code or a passkey.

​
Passkeys

A passkey signs you in with a fingerprint, face, or device PIN. The browser has to support passkeys. If it does not, the page says so. Add a passkey and give it a name you will recognise. You can add more than one and remove one you no longer use. Adding or removing asks you to confirm with a current second factor when one is already on the account.

​
Recovery codes

Setting up the authenticator app or a passkey issues 10 recovery codes. Each code works once. They are shown only at that moment. Copy them and store them somewhere safe. Make new codes deletes the old set and shows 10 new ones. A used code cannot be used again. When none are left, make a new set while you can still sign in.

​
Countries

Countries you send to lists the destinations this workspace may send to. Turning off a country you never use limits what a leaked key can spend. When the mode is enforced, a send to a country that is off returns 403 country_not_enabled. When the mode is warn, the send is not refused for this reason. Saving the list needs settings.write.

​
Danger zone

Danger zone has one action: delete the workspace. The delete button is disabled. The page says to contact support to delete the workspace. Deleting removes the workspace, all API keys, OTPs, webhooks, and credit history. It cannot be undone. Open a ticket from Support, category Account and access, from the owner account. Include the workspace name. Do not paste API keys.