Skip to content
SoundSyncAudio software platform

Guide

Account Security

Password changes, two-factor authentication, recovery codes, and workspace access.

Start with getting startedExplore API docs

SoundSync

Set up an authenticator

  1. Open account security

    Sign in to your own account and open the security controls in Settings. Keep account credentials separate from product keys and reseller tokens.

  2. Confirm your password

    Enter your current account password to begin two-factor setup. The setup secret is private; do not send it to support or include it in a screenshot.

  3. Add the account to your authenticator

    Use the displayed setup information in your authenticator application. Generating a secret does not enable protection yet.

  4. Confirm enrollment

    Enter the current six-digit authenticator code and finish the enable action. Wait for confirmation before leaving Settings.

  5. Save the recovery codes

    Copy the returned recovery codes to a private password manager or secure offline location. Each code is a single-use fallback; SoundSync stores hashes rather than recoverable copies.

  6. Check the next sign-in

    Use your email and password, then complete the two-factor challenge with a current authenticator code. Do not close your existing signed-in session until you have confirmed the new method works.

Use a recovery code when the authenticator is unavailable

At the two-factor sign-in challenge, use an unused recovery code instead of an authenticator code. A successfully used recovery code cannot be used again. Keep track of which codes remain and do not share them with a teammate.

If a time-based code is rejected, check the authenticator account and automatic device time, then use a newly generated code. Repeatedly requesting setup or changing unrelated product credentials does not repair an account sign-in challenge.

SoundSync

Replace a lost or compromised authenticator

  1. Recover access

    Complete sign-in with an unused recovery code if your authenticator is unavailable.

  2. Remove the old factor

    In account security, disabling two-factor authentication requires your current password and a valid authenticator or recovery code.

  3. Enroll the replacement

    Start setup again, confirm a code from the replacement authenticator, and store the newly returned recovery codes. Do not rely on the old recovery set.

  4. Review access

    Change a compromised account password and review team roles and product access. Removing a person from a workspace is separate from changing your own factor.

If no authenticator or recovery code remains

Contact support@soundsyncsolutions.biz from your account email and explain that you cannot complete two-factor sign-in. Do not include a password, setup secret, recovery code, serial, or payment-card details. Account recovery requires review; this guide does not promise an automatic bypass or a completion deadline.

A password-reset email is not a promise that two-factor protection will be removed. Protect access to the email account as well as the SoundSync account.

Personal account protection and team access are separate

Two-factor authentication protects the account that enabled it. This is not an organization-wide enforced-MFA policy. Team members use individual accounts with scoped roles and product assignments; do not distribute the owner password or recovery codes.

Account closure and personal-data deletion are support-reviewed procedures, not a self-service delete or session-management API advertised by this guide.

SoundSync

Account sign-in and security calls

These are the current first-party account calls used by account settings and sign-in. They are not an OAuth provider, an organization-wide MFA API, or a replacement for plugin product credentials. Self-service session revocation and account deletion are not advertised here.

POST /api/auth/login

Sign in or complete a two-factor challenge

Auth
Public request; operation-specific verification still applies
Scope
Only the matching verified account.
Request fields
  • email: string (required)
  • password: string
  • twoFactorToken: string
  • twoFactorCode: string
  • role: string
  • marketingOptIn: boolean
  • marketingOptOut: boolean
Returns
200: account result and token, or twoFactorRequired and twoFactorToken. A challenge token is not an account session.
Notes
A wrong or expired challenge returns 401. Never store or log the password, authenticator setup secret, recovery code, or tokens in public examples.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "password": {
      "type": "string"
    },
    "twoFactorToken": {
      "type": "string"
    },
    "twoFactorCode": {
      "type": "string"
    },
    "role": {
      "type": "string"
    },
    "marketingOptIn": {
      "type": "boolean"
    },
    "marketingOptOut": {
      "type": "boolean"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": true,
  "anyOf": [
    {
      "required": [
        "password"
      ]
    },
    {
      "required": [
        "twoFactorToken",
        "twoFactorCode"
      ]
    }
  ]
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string"
    },
    "user": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    },
    "twoFactorRequired": {
      "type": "boolean"
    },
    "twoFactorToken": {
      "type": "string"
    },
    "code": {
      "type": "string"
    },
    "message": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 401, 403, 500, 503.

GET /api/account/security

Read your account security status

Auth
Account Bearer JWT
Scope
The signed-in personal account only; not an effective developer workspace or product assignment.
Returns
200: current account security status.
Request, response and error reference

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "user": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "email": {
          "type": "string",
          "format": "email"
        },
        "firstName": {
          "type": [
            "string",
            "null"
          ]
        },
        "lastName": {
          "type": [
            "string",
            "null"
          ]
        },
        "role": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "security": {
      "type": "object",
      "properties": {
        "twoFactorEnabled": {
          "type": "boolean"
        },
        "twoFactorSetupPending": {
          "type": "boolean"
        },
        "recoveryCodesRemaining": {
          "type": "integer",
          "minimum": 0
        },
        "activeSessionCount": {
          "type": "integer",
          "minimum": 0
        },
        "twoFactorEnabledAt": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 401, 404, 500, 503.

POST /api/account/2fa/setup

Begin authenticator enrollment

Auth
Account Bearer JWT
Scope
The signed-in personal account only; not an effective developer workspace or product assignment.
Request fields
  • currentPassword: string (required)
Returns
200: secret, otpauthUrl, issuer. Treat the entire response as private.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "currentPassword": {
      "type": "string"
    }
  },
  "required": [
    "currentPassword"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "secret": {
      "type": "string"
    },
    "otpauthUrl": {
      "type": "string"
    },
    "issuer": {
      "const": "SoundSync"
    }
  },
  "additionalProperties": true
}

Documented failures: 401, 404, 500, 400, 409, 503.

POST /api/account/2fa/enable

Confirm a code from the pending authenticator

Auth
Account Bearer JWT
Scope
The signed-in personal account only; not an effective developer workspace or product assignment.
Request fields
  • code: string (required)
Returns
200: message and single-use recoveryCodes. Save them privately.
Notes
Personal account enrollment, not a workspace operation. The pending secret is checked under a row lock and consumed in the same transaction that saves the verified authenticator and recovery hashes. Concurrent or repeated enable requests return 409 after one succeeds; they do not rotate a live factor or return another recovery set. An invalid code or failed save leaves enrollment uncommitted.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string"
    }
  },
  "required": [
    "code"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "recoveryCodes": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 401, 404, 409, 500, 503.

POST /api/account/2fa/disable

Disable your enrolled authenticator

Auth
Account Bearer JWT
Scope
The signed-in personal account only; not an effective developer workspace or product assignment.
Request fields
  • currentPassword: string (required)
  • code: string (required)
Returns
200: confirmation message.
Request, response and error reference

Request (application/json)

{
  "type": "object",
  "properties": {
    "currentPassword": {
      "type": "string"
    },
    "code": {
      "type": "string"
    }
  },
  "required": [
    "currentPassword",
    "code"
  ],
  "additionalProperties": true
}

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 401, 404, 500, 400, 503.

SoundSync

Recover a customer sign-in

What you seeWhat to do
Purchased before, but never created a passwordChoose Reset password on the same storefront and use your purchase email to set up access. Do not create another purchase to recover an existing product.
The browser could not save your sign-in sessionAllow required site data/storage for this website, check browser privacy or storage restrictions, and retry. The page verifies that the session was saved before opening the account.
Email or password rejectedCheck the purchase email and the intended customer/developer sign-in. Use Reset password if needed. The form keeps entered values and supports retry.
Email verification or authenticator requestedComplete that specific challenge. A verification notice or two-factor challenge is not a completed session, and a password reset does not bypass two-factor authentication.
Connection, service, or rate-limit errorFollow the visible recovery message and wait where required. Repeated submissions do not repair a network problem; avoid creating duplicate accounts or purchases.

Return to the intended store

Use the recovery link on the storefront where you are trying to sign in. Its supported store and return path are retained so recovery can lead back to the intended product or account. Keep reset links private. Browser storage is required for the saved sign-in session. Developer-configured GA4 on eligible custom-domain public pages runs automatically; it is separate from sign-in storage and does not honor a saved analytics decline.

Support does not replace account verification

A developer can help with eligible verification resends and supported profile corrections, but cannot set your password or change your linked login email. Use your account settings for a verified email change and Reset password for recovery. An unverified contact correction is not a verified account change.

When a session cannot be checked

A signed account token must still match an active stored session. Revoked sessions return 401 SESSION_REVOKED. If the session store cannot be checked, protected account requests stop with 503 SESSION_VERIFICATION_UNAVAILABLE rather than continuing with unverified access.

Retry after a temporary availability problem. Do not treat 503 as permission to bypass authentication or automatically create a second payment, refund or other financial action. Reconcile the specific operation before repeating a write. Product credentials and customer library tokens have separate authentication contracts.

SoundSync

Account API reference

Accounts and recovery

Registration, reset, sign-out and verified profile changes.

Explore

Password changes, recovery codes and sign-out

A successful password change saves the new password and revokes the other stored account sessions together. If revocation fails, the password change is rolled back and the request fails. With a recognized current token, that session is retained; without one, all stored sessions for the account are revoked.

Recovery codes are single-use, including concurrent attempts: only the request that consumes the code can complete that recovery-code sign-in. Disabling two-factor authentication checks the current password and factor against locked current account state. A failed logout returns 503 SESSION_REVOCATION_UNAVAILABLE, not a completed sign-out. Retry and do not treat client-side token removal as confirmation that the server session was revoked.

Confirm enrollment once

Setup and enable actions are serialized against the current account state. Confirm a code from the latest setup. Only one concurrent enable can succeed; a repeated enable returns 409 and does not replace the active authenticator or return a second recovery set. Starting setup on an already enabled account also returns 409. Recover or disable the existing factor before enrolling a replacement.

Native account login with two-factor authentication

The updated JUCE 0.7.3 and HISE Native C++ 0.5.2 sources support the customer account two-factor challenge. Regenerate the complete package, replace the matching sources and rebuild the plugin; an older installed binary does not acquire this behavior from a documentation or server update.

Sign in with the customer email and password. If two-factor authentication is enabled, the account form changes to Authenticator or recovery code. Enter a current authenticator code or an unused recovery code and choose Verify code. A challenge is not a customer session, entitlement or device activation; the plugin remains locked until verified account login and product/device activation succeed.

An invalid code can be retried. An expired challenge requires signing in again. The challenge lasts up to ten minutes and is kept only in the running native client, not the activation cache, logs or public state. Account passwords, two-factor codes and account session tokens are not saved in the license cache. Do not disable two-factor protection to integrate a plugin.

Account sessions must be verifiable

A signed account token is not enough on its own: customer account requests also check that the session is still allowed. If that check is unavailable, protected library, invoice, review, device-reset, download and customer-token activation requests stop before returning private data or performing the protected action.

503 SESSION_VERIFICATION_UNAVAILABLE means verification could not finish. Retry after service recovery; it does not mean that the purchase disappeared or the session was confirmed revoked. A confirmed revoked session returns 401 LIBRARY_SESSION_REVOKED and requires sign-in again. Do not grant access on either response.

Shared library/download tokens retain their separate token and ownership checks. Optional storefront personalization can fall back to anonymous browsing when customer identity cannot be established; that does not authorize a private download. This account-session check does not replace the signed JUCE offline-grant policy.