Authentication
Two credentials, two jobs:
Signing in always happens in the app — email and password, one-time code,
magic link, or the Google/GitHub buttons on the
login page. The app keeps your session
alive and refreshes it for you. Create the API key in your dashboard while
logged in (see API keys). Services and scripts use the
key; browsers use the login session.
Accounts with two-factor authentication confirm with a code at sign-in.
Several failed password attempts lock sign-in briefly.
Sessions
Review your active sessions in the dashboard security settings and revoke any you do not recognise. Signing out there ends the session.Which credential where
Every data endpoint in these guides takesX-API-Key. Sign-in, session and
password flows live in the app, never in integration code.