Security
Secure sessions, 2FA, CSRF protection, and scoped API keys
Security is a first-class feature of the app. Session cookies stay httpOnly, mutating browser requests are CSRF-protected, API keys are hashed, and users can manage sessions and 2FA from settings.
01Section
Browser sessions
Authentication uses JWT-in-cookie sessions with server-side validation and session tracking.
02Section
Two-factor auth
Users can set up TOTP, verify it, disable it, and recover access with recovery codes.
03Section
Session control
Users can review active sessions and revoke one, many, or all sessions from the account settings flow.
04Section
API access
Developer API keys are hashed, scoped by resource, and revocable without touching the user session.
Best practice
A practical example for this feature.
- Use read-only keys by default.
- Rotate keys when they are shared with a new integration.
- Revoke old sessions and keys when access changes.