Account security

Public Url is built on Better Auth with workspace-scoped access control. This guide covers the sign-in and hardening options available to your account and workspace.

Sign-in methods

• Email and password — email verification is required before sign-in completes.
• Magic links — passwordless sign-in over email.
• Social sign-in — Google, GitHub, Microsoft, Apple, LinkedIn, Facebook, Discord, Slack, GitLab, and X (providers are enabled per deployment).
• Passkeys — register a device passkey for phishing-resistant sign-in.
• SSO — enterprise workspaces can enforce single sign-on through their identity provider.

Two-factor authentication

Enable TOTP two-factor authentication from Settings → Security. Once enabled, sign-in requires a code from your authenticator app. Workspaces can also require two-factor for all members — members without it are blocked until they enroll.

Sessions and devices

The security settings page lists active sessions with device, location, and IP context (resolved through GeoIP). Revoke any session you do not recognize; revoking takes effect immediately.

Security log and audit log

• The security log records account-level events: sign-ins, password changes, two-factor enrollment, passkey registration, and session revocations, each with IP and geo context.
• The audit log records workspace-level activity — link, domain, member, and settings changes — for compliance review.

API keys

Programmatic access uses workspace API keys created under Settings → API keys. Keys are shown once at creation, stored hashed, and can be scoped with IP allow-lists. See API authentication for usage.