# Settings

> The six tabs of the account Settings screen: sign-in security and SSO, MCP access keys, white-label branding, provider and vendor credentials, recording storage, and the audio library.

**Settings** is the account-wide configuration screen. It holds what applies
to the whole organization, not to one product: how people sign in, which
credentials FirstByte uses to reach other services, and what every console
looks like.

Per-product configuration does not live here. A trunk belongs to Voice, an app
key belongs to Realtime, and each console keeps its own. Settings holds only
what crosses products.

The screen has six tabs.

| Tab | What it holds |
| --- | --- |
| Account & Security | Sign-in security, password, connected accounts, SSO |
| API Keys | MCP access keys, and a pointer to where each product key is created |
| Branding | White-label appearance for every console |
| Credentials | Keys FirstByte uses to reach model and vendor APIs |
| Storage | Recording storage use for the organization |
| Audio | The shared audio library |

Telephony tools are managed in the Voice AI console under **Telephony tools**.

## Account & Security

Four surfaces, all about how a person proves who they are.

- **Security** — multi-factor authentication for your own account.
- **Password** — change it. This is the only place the portal writes one.
- **Connected accounts** — the social identities linked to your account, if
  your deployment enables them.
- **SSO** — single sign-on for the organization. Once SSO is enforced, members
  sign in through your identity provider instead of a password.

> **NOTE:**
> MFA and password apply to YOU. SSO applies to the ORGANIZATION. Changing SSO
>   changes how every member signs in, so it is an administrator action.

## API Keys

The tab holds the organization's **MCP access keys**. An MCP access key
(`mpk_`) lets a coding agent or an MCP client call the platform's MCP server
(`POST /mcp`) as you. See [MCP](/platform/mcp).

- Only an owner or an admin can mint or revoke a key. Every member can see
  the list. The list shows a preview of each key, not the full value.
- When you mint a key, you give it a name and you pick its scopes in the
  **scope grid**: one row per domain, one column per action (read, write,
  delete, admin). The key gets only the scopes you tick.
- The full key is shown one time, when you mint it. Copy it then. You cannot
  read it back later.
- **Revoke** stops a key at once. A revoked key cannot be restored.

> **WARNING:**
> An MCP access key acts as the person who minted it. It stops working when
>   that person's membership ends.

Below the MCP access keys, the **Product API keys** card points to the product
consoles. A key for one product (Voice, CTI, Streams, Tunnel) is created in
that product's console, not here. See
[Credential types](/concepts/credentials) for the full map.

The **Re-sync engine credentials** button sends the organization's engine
credentials to the engine again. You do not need it in normal operation. Use
it when FirstByte support asks you to.

## Branding

White-label appearance: the name, logo and colours every console renders.

Branding is deployment-wide. It is the only setting on this screen that changes
what EVERY console shows — the portal, the Contact Center and Voice AI
consoles, and each modality SPA. A change here is visible to every member of the organization at once.

## Credentials

Two kinds, and the difference matters:

- **Provider credentials** — the organization-wide default keys FirstByte
  uses to reach a model provider on your behalf. A voice agent with no key of
  its own falls back to these.
- **Vendor credentials** — keys for a third-party platform FirstByte bridges
  to.

Both are stored sealed and are never returned to the browser after you save
them. The screen shows that a credential is set, not what it is.

> **NOTE:**
> A voice agent can carry its own provider key on its Keys tab. That override
>   wins. Use the organization default for the common case and the per-agent key
>   when one agent must bill to a different account.

## Storage

How much recording storage the organization uses. The tab reports the managed,
per-tenant recording bucket: the bucket, the tenant prefix, the retention, and
the current usage. A trunk with its own `recording_url` writes to your bucket
instead, and that usage does not appear here. See
[Managed recording storage](/platform/diagnostics#managed-recording-storage).

## Audio

The shared audio library: hold music, prompts and any other clip an agent or a
queue plays. Uploading a clip here makes it selectable everywhere it can be
played.

## Where the other settings are

| Looking for | It is here |
| --- | --- |
| Spend and usage | [Billing](/platform/billing) |
| Who can reach which product | Access management, in the portal |
| Trunks, numbers, dispatch rules | The Contact Center or Voice AI console |
| API keys | Each modality's own console |
| Voices | The Agents screen — a voice is an agent asset, not an account setting |