Secure your account (2FA, strong passwords, tokens)
Harden your Victus account: enable two-factor authentication, use a strong unique password, and never share API keys, reseller keys, or panel tokens.
Your Victus account can control real infrastructure — game servers, full KVM virtual machines with root access, bots, and prepaid credit. That makes it a target. A few minutes of hardening prevents almost all account takeovers. The three pillars are: enable two-factor authentication, use a strong unique password, and never share your tokens or keys.
Enable two-factor authentication (2FA)
- Log in and open your account / security settings (on the control panel this is under your Account area).
- Choose to enable two-step / two-factor authentication.
- Scan the QR code with an authenticator app such as Google Authenticator, Authy, or Aegis.
- Enter the 6-digit code the app generates to confirm and activate 2FA.
- Save the one-time recovery codes somewhere safe and offline — a password manager or printed copy.
If you lose your authenticator device and do not have recovery codes, regaining access requires a manual ownership check via a support ticket, which is slow. Save the codes the moment 2FA is enabled.
Use a strong, unique password
- At least 12–16 characters — length beats complexity.
- Unique to Victus; never reuse a password from another site.
- Use a password manager to generate and store it (Bitwarden, 1Password, KeePassXC).
- A passphrase of 4+ random words is both strong and memorable.
Never share tokens, keys, or codes
Victus and its staff will NEVER ask for your password, your 2FA codes, or your API/reseller keys. Anyone who does is attempting to phish you. Treat the following as secrets equivalent to a password:
- Reseller API keys (they start with rslr_) — anyone holding one can spend your prepaid credit and provision services.
- Panel API keys / client tokens used for automation.
- VPS root passwords and SSH private keys.
- Database passwords shown in the panel Databases tab.
- One-time 2FA codes and recovery codes.
# Reseller key example — treat like a password.
# Pass it via an environment variable, never hard-code or paste it in chat/screenshots.
export VICTUS_RESELLER_KEY="rslr_xxxxxxxxxxxxxxxxxxxx"
curl -H "Authorization: Bearer $VICTUS_RESELLER_KEY" \
https://control.victuscloud.com/api/reseller/v1/...If you accidentally commit a reseller/API key to Git, paste it in a screenshot, or share it, revoke it from the panel Reseller API page and mint a new one right away. Then check your credit balance and recent activity for anything you did not do.
Always log in via the real domains: billing.victuscloud.com and control.victuscloud.com. Check the URL before entering credentials, and be suspicious of DMs offering free credits, "verification" links, or urgent account warnings.