> ## Documentation Index
> Fetch the complete documentation index at: https://tunnelfleet.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in to TunnelFleet, manage organizations, and understand VPN user credentials.

TunnelFleet has two separate authentication layers: your **dashboard account**, and **VPN user credentials** on each server.

## Dashboard authentication

TunnelFleet uses email and password authentication.

| Action                          | Where                                                                                      |
| ------------------------------- | ------------------------------------------------------------------------------------------ |
| Register                        | [tunnelfleet.com](https://tunnelfleet.com) — creates your user and a personal organization |
| Sign in                         | Email + password                                                                           |
| Email verification              | Required before some billing and provisioning actions                                      |
| Password reset                  | Forgot-password flow on the login page                                                     |
| Two-factor authentication (2FA) | Account settings                                                                           |

### Organizations and roles

Every account belongs to at least one **organization**. Your personal organization is created at registration.

See [Organizations](/docs/organizations) and [Members](/docs/organizations/members) for roles, invites, billing, and settings.

Invite teammates by email. Roles control what members can do:

| Role    | Typical access                               |
| ------- | -------------------------------------------- |
| Owner   | Full control, including billing and deletion |
| Admin   | Manage servers, users, and members           |
| Manager | Day-to-day server and VPN user operations    |
| Viewer  | Read-only access                             |

URL pattern for org resources:

```
https://tunnelfleet.com/{org-handle}/servers
```

### License and affiliate sign-in

If you purchased through a partner (for example AppSumo or StackSocial), redeem your license at the partner redeem page under `/redeem/{vendor}` instead of starting a normal paid trial.

## VPN user authentication

VPN users are **not** TunnelFleet dashboard logins. They are credentials provisioned on a specific server for client apps.

| Protocol          | Auth model                                                       |
| ----------------- | ---------------------------------------------------------------- |
| WireGuard         | Key-based peers — download a `.conf` or scan a QR code           |
| OpenVPN TCP / UDP | Username + password embedded in or used with the `.ovpn` profile |

A default VPN user named **`tunnelfleet`** is created during server provisioning.

<Tip>
  Treat VPN passwords and WireGuard private keys like secrets. Rotate credentials from the server **Users** tab if a device is lost.
</Tip>

## Security recommendations

* Enable **2FA** on your TunnelFleet account
* Prefer WireGuard for personal devices when clients support it
* Use OpenVPN TCP on networks that block UDP VPN traffic
* Revoke VPN users immediately when someone leaves your team
* Keep root SSH on the VPS locked down (key-based SSH, no password login)

## Next steps

<Card title="Deploy your first server" icon="server" href="/docs/getting-started/deploy-your-first-server">
  Create a server and run the install script.
</Card>