Settings and Security
Monize provides comprehensive security features and configurable user preferences.
- User Settings
- Two-Factor Authentication (2FA)
- Trusted Devices
- Password Management
- Account Lockout
- Single Sign-On (OIDC)
- Personal Access Tokens (PATs)
- Backend Connectivity
- Security Architecture
- Admin Features
Navigate to Settings (gear icon in the top-right corner) to configure your preferences.
| Setting | Description |
|---|---|
| Home Currency | Primary currency for reporting and dashboard totals |
| Date Format | How dates are displayed throughout the application |
| Number Format | Decimal and thousands separator preferences |
| Theme | Light or dark mode |
| Email Notifications | Toggle email notifications for bills and reminders |
Monize supports Time-based One-Time Password (TOTP) authentication for an additional layer of security.
- Navigate to Settings
- Click Enable Two-Factor Authentication
- Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
- Enter the 6-digit verification code to confirm setup
- Save your backup codes in a secure location (see Backup Codes below)
After enabling 2FA:
- Enter your email and password as normal
- You will be prompted for a 6-digit TOTP code
- Enter the code from your authenticator app
- Optionally check "Trust this device" to skip 2FA on this device for future logins
When you enable 2FA, Monize generates 12 single-use backup codes. These are your fallback if you lose access to your authenticator app.
- Each code is an 8-character hexadecimal string (e.g.,
a1b2c3d4) - Codes are displayed only once at generation time -- save them in a secure location
- Each code can only be used once; after use, it is permanently removed
- During 2FA verification, you can enter a backup code instead of a TOTP code
- To regenerate backup codes, navigate to Settings and click Generate Backup Codes
Security Note: Backup codes are hashed with bcrypt before being stored in the database. The plain-text codes are never stored on the server.
- Navigate to Settings
- Click Disable Two-Factor Authentication
- Enter your current TOTP code to confirm
When logging in with 2FA, you can mark a device as "trusted" to skip the TOTP prompt on future logins from that device.
- Navigate to Settings
- Scroll to the Trusted Devices section
- View all currently trusted devices
- Click Remove to revoke trust for any device
Security Note: Trusted device tokens are stored as SHA-256 hashes in the database. The actual token is stored only in the browser cookie.
- Navigate to Settings or Change Password
- Enter your current password
- Enter and confirm your new password
- Click Save
Password changes immediately revoke all existing refresh tokens, logging you out of all other sessions.
Monize checks new passwords against the Have I Been Pwned database to prevent you from using passwords that have appeared in known data breaches.
- Checked during registration and password reset
- Uses the HIBP k-anonymity API -- only the first 5 characters of the password hash are sent, so your full password is never transmitted
- If the password has been found in a breach, you will see: "This password has been found in a data breach. Please choose a different password."
- If the HIBP service is unavailable, the password is allowed (availability over security)
- On the login page, click Forgot Password
- Enter your email address
- Check your email for a reset link
- Click the link and set a new password
Security Note: Password reset tokens are hashed with SHA-256 before being stored in the database. The token expires after a set time period.
Monize protects against brute-force login attacks with automatic account lockout.
| Setting | Value |
|---|---|
| Max failed attempts | 5 consecutive failures |
| Base lockout duration | 30 minutes |
| Escalation | Exponential backoff (30 min, 60 min, 120 min, etc.) |
- After 5 consecutive failed login attempts, the account is locked
- The lockout duration doubles with each subsequent lockout cycle:
- 1st lockout (5 failures): 30 minutes
- 2nd lockout (10 failures): 60 minutes
- 3rd lockout (15 failures): 120 minutes
- If email is configured, a lockout notification is sent to the account owner
- A successful login resets the failure counter and clears any lockout
Note: Login attempts for non-existent accounts return a generic "Invalid credentials" message and do not reveal whether the account exists.
Monize supports OpenID Connect (OIDC) for single sign-on integration with identity providers.
- Authentik
- Authelia
- Pocket-ID
- Any OpenID Connect-compatible provider
OIDC is configured via environment variables:
OIDC_ISSUER=https://your-identity-provider.com
OIDC_CLIENT_ID=monize
OIDC_CLIENT_SECRET=your-client-secret
OIDC_REDIRECT_URI=http://localhost:3001/auth/callbackWhen OIDC is configured, a "Sign in with SSO" button appears on the login page.
Personal Access Tokens provide API access for external integrations such as MCP clients. Tokens are managed in Settings > AI under the MCP / Personal Access Tokens section.
Each token is created with one or more scopes that control what operations it can perform:
| Scope | Description |
|---|---|
| read | Read access to accounts, transactions, categories, payees, and other resources |
| write | Create, update, and delete resources |
| reports | Access to report generation endpoints |
Scopes are enforced server-side via a scope guard. Endpoints decorated with required scopes will reject tokens that lack the necessary permissions.
- Tokens are prefixed with
pat_for easy identification - The full token is displayed only once at creation time
- Tokens are stored as SHA-256 hashes in the database
- Tokens can have an optional expiration date
- Revoke a token at any time from the settings page
- Tokens are rejected if the owning user account is locked or disabled
For MCP integration details, see AI > MCP Server.
If the Monize backend becomes unavailable (e.g., during a server restart or network issue), the frontend automatically detects the outage and displays a notification banner.
- When any API call receives a 502 status or no response (network error), the frontend enters "backend down" mode
- A red banner appears at the top of the page: "Connection Lost -- Unable to reach the server. Retrying automatically..."
- The frontend polls the backend health endpoint (
/health/live) every 5 seconds - When the backend responds successfully, the page reloads automatically to restore normal operation
This prevents false logouts during temporary backend outages -- instead of being redirected to the login page, you see a clear status message and automatic recovery.
Monize implements comprehensive security measures:
| Feature | Implementation |
|---|---|
| Password Hashing | bcrypt with salt rounds |
| Password Breach Check | HaveIBeenPwned k-anonymity API on registration and password reset |
| Account Lockout | 5 failed attempts triggers lockout with exponential backoff |
| Access Tokens | JWT with 15-minute expiry |
| Refresh Tokens | 7-day rotating tokens with family-based replay detection |
| TOTP Encryption | Per-user unique salt (not shared secret) |
| 2FA Backup Codes | 12 single-use codes, bcrypt-hashed, generated on 2FA setup |
| Personal Access Tokens | Scoped (read/write/reports), SHA-256 hashed, revocable |
| Rate Limiting | 100 req/min global, 3-5 per 15 min on auth endpoints |
| Feature | Implementation |
|---|---|
| User Isolation | All database queries filter by userId |
| Input Validation | DTO validation with whitelist mode (rejects unknown fields) |
| SQL Injection | Parameterized queries via TypeORM |
| XSS Protection | No dangerouslySetInnerHTML, HTML escaping in emails |
| CSRF | Token validation with httpOnly cookies |
| Header | Value |
|---|---|
| Content-Security-Policy | Restrictive CSP with style-src and script-src whitelist |
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | DENY |
| Referrer-Policy | strict-origin-when-cross-origin |
| Cross-Origin-Opener-Policy | same-origin |
| Cross-Origin-Resource-Policy | same-origin |
| Permissions-Policy | Restrictive policy |
Users with the admin role have access to additional features.
Navigate to Admin > User Management to manage application users.
Admin capabilities:
- View all registered users
- Change user roles (user/admin)
- Disable or enable user accounts
- Reset user passwords
Note: The admin section only appears in the navigation if your user account has the admin role.