Authentication & MFA

Password plus optional TOTP. Email confirmation before the account can sign in. MFA protects the account, not the raw URL.

Account

New accounts confirm email with a mailed code before they can sign in. Dashboard, API, and settings require a verified address.

Authenticator

Every account can enable TOTP from Settings. After the password, sign-in asks for a six-digit code or a one-time recovery code. Secrets are encrypted at rest. Recovery codes are hashed and shown once.

MFA protects the account that hosts scripts. It does not replace a fetch token on private raw URLs.