Email sign-in
A six-digit code expires after 10 minutes and allows at most five verification attempts. Each code can create a session once. Requests are limited by email and source address to reduce abuse. A successful first sign-in grants 20 decision credits.
API keys
Paid accounts with active API access can create named keys in the dashboard. The full key is shown once. Store it in a secret store and send it in the Authorization header. The service stores a hash of the key, not the recoverable value.
Revoke a key if it has been shared or if an integration no longer needs access. Revocation prevents future API requests using that key.
Session boundaries
Workspace sessions use HttpOnly cookies and expire after 30 days. Sign out on shared devices. A session cookie is not a substitute for a server-side API key, and an API key does not authorize browser account management.