Authentication & security

Keep your credentials private and your integrations scoped.

Browser sessions

Sign-in uses a secure, HTTP-only session cookie. The backend validates user ownership and permissions on each protected action. Signing out revokes the session.

API authentication

Authorization: Bearer YOUR_API_KEY

Create and revoke keys in Settings → General. A key is displayed once. Keep it in server configuration or your automation’s credential store. Never place it in public JavaScript.

Workspace isolation

A connection belongs to its authenticated workspace. IDs alone do not grant access. Administrative roles control actions, and access to another user’s message content requires a privileged content role.

Webhook secrets

Custom credentials are encrypted at rest and omitted from ordinary settings responses. Delivery logs redact secrets. Only send requests to endpoints you control or are authorized to use.

Acceptable use

Connect only accounts you are authorized to use. Obtain required recipient consent, honor opt-outs, follow the provider’s policies, and avoid spam or abusive automation. See the Acceptable Use Policy.