Authentication

Safely use browser sessions, OAuth, API keys, verification, recovery, and device authorization.

The browser product uses secure HTTP-only sessions. GitHub and Google OAuth are available only when configured. Potion restricts callback and post-authentication redirects to trusted application origins.

API keys

API keys are displayed once. Store them in a secret manager, choose the minimum scopes, and revoke credentials that are no longer needed. Potion stores only a hash of the secret.

Device codes

Device authorization presents a short user code in the browser. Confirm the requesting client and requested scopes before approval. Codes expire and polling is rate limited.