Authentication
Passkeys, passwords and two-factor sign-in.
Sign-in is password-based with modern options bolted on:
Passkeys (WebAuthn)#
Register a passkey from your account settings — a hardware key, phone or
platform authenticator. Sign-in then works from the login screen without a
password: Register, name the device, and Revoke it when the device
changes. Passkeys are per user, so each member manages their own.
Passwords and 2FA#
Passwords are hashed with bcrypt and rate limited at the auth endpoints. For accounts that matter more, enable TOTP two-factor authentication: set it up from account settings, and each sign-in asks for the code. The setup hands you a set of single-use recovery codes — store them somewhere safe; they are the only way back in if the authenticator is lost.
Sessions#
Signed-in sessions are JWT cookies configurable at the platform level. Audit and account screens show where your session lives, and sign-out revokes it server-side.