Account, plans and security
Every new account gets 7 days of Pro, no card. After that it goes to Free on its own unless you subscribe.
Free is for watching: observe mode on every rule, with the counts of what each one would have done; IP lists, Tor, rate limits and AI crawlers; managed rules counting what they would block; the scanner and security headers; captcha for any form. One site per account.
Pro enforces everything: waiting room and capacity, challenge, bot score actions and under attack mode, login protection, forms, access gates, your own rules, CSP, blocking managed rules. Up to 5 sites per account.
Pro is charged by Stripe, by card, monthly or yearly (yearly is cheaper per month). Subscribe in Account › Subscription; the same screen opens the Stripe portal to change the card, see receipts or cancel. Cancel any time: Pro stays on until the end of the period you paid for. Prices are shown on that screen and at qlyne.com.
An account holds several sites, each with its own rules, connector and reports. Add one in Account › Sites. The site id is permanent (it is the QLYNE_TENANT of the connector), 3 to 32 letters, numbers, - or _. A site’s domain is confirmed with a TXT record; the scanner and hosting by Qlyne need it.
Members
Section titled “Members”Account › Members lists who signs in to the account. Add a person by e-mail: they get a link to set a password, valid for one hour. Every member sees every site of the account. An account keeps at least one member, and nobody can remove themselves. An e-mail address signs in to one account only.
Signing in
Section titled “Signing in”Two things are required for every member, with no way to turn them off:
- Confirmed e-mail: the panel waits for the confirmation link before showing anything.
- Two-factor sign-in: an authenticator app (Authy, Google Authenticator, 1Password) with a code at every sign-in. The setup happens right after the first sign-in, with recovery codes to store somewhere safe. Lost the phone? Use a recovery code, then set the app up again in Settings › Two-factor authentication.
API key
Section titled “API key”One key per account, for rules as code, metrics, your backend’s calls to the Core and AI assistants over MCP. It is shown once, when generated in Account › API key; store it then. Making a new key stops the old one within a minute, so update your scripts first. The site goes in X-Tenant-ID on API calls.