Settings
Settings is a list of sections. Each section has its own page and its own address, so you can bookmark one or send a link to it. On a computer the sections stay in a column on the left of every settings page; on a phone, Settings is the list and each section has a Settings link back to it. Everyone sees only the sections they can use: a staff member does not see Billing, and an accounting firm's people working in your books manage their own team from the firm console instead of People.
| Section | Address | What is there |
|---|---|---|
| Company | /app/settings/company | The company profile printed on invoices, estimates, statements and receipts (names, address, logo, brand colour, payment instructions, terms); the time zone your days follow; the fiscal year; periods and locks; the chart of accounts, default accounts and bank accounts. |
| People | /app/settings/people | Your people, their roles, invitations; roles (on plans with your own roles); your accountant: which firm has access and what it may do. The firm's people are listed with their role at the firm and the firm's name (for example "Manager at Okafor & Partners CPAs · CPA on these books"), not with a company role. |
| Sign-in and keys | /app/settings/security | Your email address, passkeys, authenticator app, recovery codes, where you are signed in, API keys, connected AI apps, and the company's two-step sign-in requirement. |
| Notifications | /app/settings/notifications | Email to your customers: payment reminders, Reply-To, sender name, security notices, the wording of each email; customer statements; the monthly agent audit report by email. |
| Data | /app/settings/data | Export your books, import from QuickBooks, AI and your data, AI consent (§7216), support access, audit anchors, and deleting the company. |
| AI agents | /app/settings/agents | Every agent in your books, what it did, its limits and keys; pause one, or stop all agents. |
| Integrations, Webhooks | /app/settings/integrations, /app/settings/webhooks | Connections that post as their own agent; events sent to your own code. |
| Receipt inbox | /app/settings/receipt-inbox | A private address to forward receipts to, its easy name, and who may send to it. |
| Billing, Payments, Crypto | /app/settings/billing, /app/settings/payments, /app/settings/crypto | Your Evenbead plan (owner or CPA); customers paying by card, bank or crypto. |
| Appearance | /app/settings/appearance | Light or dark, for you on every device. |
Old links keep working: /app/settings#email opens Notifications, /app/settings#keys-h opens Sign-in and keys, and so on (without JavaScript the list scrolls to the right section).
API keys: active and retired
The API keys list shows only keys that work and are nobody's predecessor. A key that was rotated (it keeps working for its overlap window, 24 hours by default), revoked or expired is history: Show N retired keys under the list opens it. The AI agents page does the same for each agent. Agents may rotate their own keys; the monthly agent audit report shows those routine rotations as one line per agent ("key rotated 31 times this month, automatically"), and lists every revocation, kill switch and change a person made one by one. The report's JSON keeps every rotation, each marked automatic.
Confirming it's you
Some changes (keys, exports, payment settings, passkeys, what AI agents may do on their own, accountant access) ask you to confirm it's you if you have not in the last 10 minutes; such a form says so before you save ("Saving will ask for your passkey"). With a passkey or an authenticator app it takes a touch or a code, and what you entered is kept: the confirmation page shows "Waiting to save" with each change, and right after the passkey or code it is saved and you land back on the page with "Saved:" and the list. It waits 5 minutes, only for your own sign-in, and is used once. If someone changed the same settings while it waited, nothing is saved: you see what you saw, what is there now and yours, and choose. Without a passkey or an app, Sign in again and come back signs you out; after you sign in again (any way) you land back on the page that asked, for example the export, and do it again (a change cannot follow you into a new sign-in). Only a page of the app itself is remembered, for 15 minutes and once; never another site.