Skip to content
Open app
Back to guide
Security

Secure sessions, 2FA, CSRF protection, and scoped API keys

Security is a first-class feature of the app. Session cookies stay httpOnly, mutating browser requests are CSRF-protected, API keys are hashed, and users can manage sessions and 2FA from settings.

Open security
Sections
4
Reading time
1 min
Opens in app
Security

Browser sessions

You stay signed in through secure, httpOnly session cookies that page scripts cannot read, and every session is tracked so you can see and end it.

Two-factor auth

Users can set up TOTP, verify it, disable it, and recover access with recovery codes.

Session control

Users can review active sessions and revoke one, many, or all sessions from the account settings flow.

API access

Developer API keys are hashed, scoped, expiring, and revocable. OAuth connections require explicit consent and S256 PKCE, use 15-minute access tokens, rotate refresh tokens, and can be disconnected in Developer settings. App owners can rotate an OAuth client secret at any time. The Usage tab in Developer settings shows how many requests each key made and Connected apps shows when each app last used your account, so unexpected activity is easy to spot. Developer credentials cannot access account security, billing, administrator tools, or unsupported routes.

Best practice

  • Use read-only keys by default.
  • Rotate keys when they are shared with a new integration: Replace key creates one with the same access, then revoke the old key.
  • Revoke old sessions and keys when access changes.

Security topics

The main account and API protection areas.