Privacy & security
Account security
Sign-in methods, two-factor authentication, passkeys, sessions, and how to keep the identities and API keys on your account safe.
Your account is protected at two layers. Your identity, how you sign in to the dashboard, controls who can create keys, add funds and administer organizations. Your API keys authenticate code. The two are independent: signing out or changing your password doesn't revoke API keys, and revoking a key doesn't sign anyone out.
Manage your identity in Profile. These settings belong to you as a person and apply to every account you can switch to. The dashboard's Security page is different: it holds the active account's request policy.
Sign in
| Method | How it works |
|---|---|
| Email and password | Register with your email address, confirm it from the email, then choose a password |
| Passkeys | Your device's screen lock or a security key, once you've added one |
| Connected logins | Google, GitHub or Apple, when offered on the sign-in page |
Registering with email asks only for your address. Open the email and choose Complete registration, then choose a password. The link expires after ten minutes; if it expires, choose Resend email on the Check your email page. Connected logins don't need a separate confirmation: the provider supplies your email address.
Registration and password sign-in run a background security check. If asked, complete the checkbox shown above the button. If the check retries, sign-in or registration continues automatically when it succeeds. If you change a field, choose another sign-in method or let the checkbox time out first, choose Sign in or Create account again.
Your identity isn't tied to your email address. Changing your email doesn't change who you are, and an email match never grants access on its own.
If you lose every way to sign in, contact support; identity verification is required.
Forgotten password
Choose Forgot password? on the sign-in page, enter your email address and choose Send reset link, then open the email and choose Reset password. If you've set up two-factor authentication, you complete it before choosing a new password. The response is the same whether or not an account exists for that address.
Connected logins
Connected logins, in the Sign-in section of your profile, shows each available provider as Connected or Not connected.
Connect links a provider to your identity. You prove you control the provider account during the flow.
A matching email address never links accounts automatically. Signing in with a provider whose email matches your identity doesn't sign you in to it; connect the provider from your profile first.
Disconnect removes a linked provider. You can't remove your last way to sign in.
Two-factor authentication
Add an authenticator app as a second factor in Two-factor authentication:
Once it's on:
Password sign-in and returning connected-login sign-in ask for a code from the app or an unused recovery code.
Passkey sign-in doesn't ask for a code; the passkey is already a strong, device-bound factor.
Each recovery code works once. Recovery codes shows how many are left; Replace codes issues a new set.
Replace authenticator moves to a new device. Turn off two-factor authentication, in the authenticator's ⋯ menu, removes the authenticator and its recovery codes.
Passkeys
In Passkeys, in the Sign-in section, choose Add passkey, enter a Passkey name you'll recognize, and follow your browser's prompt. You can add up to 20 passkeys. Each one's ⋯ menu holds Rename and Remove passkey.
A passkey works only on the site it was created for. Add one on each device you use, or use a synced passkey provider.
Sessions
Sessions lists every browser and command-line session using your identity, with when it signed in and was last active. The current one is marked This session.
Sign out ends one session; Sign out others ends every session except this one. To end this one, use Sign out in the sidebar.
A signed-out session stops working within seconds.
Inactive sessions expire. When your session ends, the dashboard asks you to sign in again and then returns you to the page you were opening.
Signing out sessions doesn't affect API keys or provider app keys. Revoke those separately.
Changes that need confirmation
| Change | Confirmation |
|---|---|
| Change email address | A link goes to the new address. Your current address stays active until you open it; afterwards the old address is notified and your other sessions are signed out |
| Change password | Enter your Current password, New password and Confirm new password, then choose Send confirmation email. The password changes when you open the link sent to your current address, and your other sessions are signed out |
| Remove a passkey, disconnect a login, turn off two-factor authentication | You may be asked to sign in again |
Confirmation links expire after ten minutes. While a change is pending, your profile offers Resend email and Cancel request.
Change password appears only when your identity has a password; identities that sign in only with passkeys or connected logins don't have one.
Delete your account
Delete account, in your profile, permanently erases your profile and closes your personal account. It first lists anything you must resolve:
organizations where you're the only owner: make another member an owner first;
a personal balance or provider earnings that isn't zero;
pending funding, payment-method setup or withdrawals;
requests still running;
endpoints on your personal providers that still have models: delete those endpoints first.
Then sign in again, choose Send deletion code, enter the code from your email, type DELETE and choose Permanently delete account. Keys you created, in any account, are revoked. See Data retention for what is erased and what is kept.
Protect your API keys
API keys are bearer credentials: anyone who has one can spend from your balance until you disable it. Two-factor authentication doesn't protect them.
Store keys in a secret manager or environment variables. Never commit them, paste them into tickets or put them in URLs.
Keep them server-side. Browser requests from third-party origins are rejected with
403, and anything shipped to a client can be extracted.Limit the damage. Use one key per application and environment, set a spending limit on each, and give temporary keys an expiry.
Guard management keys closely. A management key can create inference keys; keep it only in the service that provisions them.
Act fast on a leak. Disable the key in Keys or with the management API, review its spend in Activity, then delete it.
Remember that keys follow their creator. In an organization, a key stops working when the person who created it leaves or is removed.
Checklist
Turn on two-factor authentication and store the recovery codes offline.
Add a passkey on each device you use.
Review Sessions now and then and sign out anything you don't recognize.
Give every application its own key with a spending limit.
Keep management keys out of application servers.