Email sign-in
A six-digit code expires after 10 minutes and allows at most five verification attempts. Each code can create a session once. Requests are limited by email and source address to reduce abuse. A successful first sign-in grants 20 decision credits, once per account.
API keys
An account with an active access period can create named keys in the dashboard, at most five per day. The key is shown once and starts with jvp_; store it in a secret store and send it in the Authorization header. The service stores a hash of the key, not the recoverable value.
Revoke a key if it has been shared or if an integration no longer needs access. Revocation prevents future API requests using that key.
Session boundaries
Workspace sessions use HttpOnly cookies and expire after 30 days. Sign out on shared devices. A session cookie is not a substitute for a server-side API key, and an API key does not authorize browser account management.