People
- Email and password sign-in with per-user accounts
- No shared logins — every action must attribute to a person
- Session expiry on inactivity
Machines
Programmatic access uses workspace-scoped API keys sent as bearer tokens over HTTPS. Keys are shown once at creation and should be stored in a secret manager, never in source control.
Key handling
Rotate a key immediately if it is pasted into a chat, a ticket, or a repository. Rotation invalidates the previous value.