Security

Polymorfa separates human Console sessions, server credentials, project credentials, and end-user client tokens. Each surface re-authorizes against live organization and project state.

​

Account authentication

The Console supports passwordless email OTP, passkeys, TOTP with recovery, configured social providers, session and device management, and the desktop device-authorization flow. The sign-in page shows only authentication methods enabled for Polymorfa. Under Account settings, add and verify secondary email addresses, select a primary sign-in address, or remove a non-primary address. Under Authentication, manage passkeys, an authenticator app with recovery codes, available social connections, browser sessions, Inspector sessions, and command-line sessions. Revoking a session removes its account access. Social sign-in and social account creation are separate actions. Signing in with a provider does not create an account implicitly; use the sign-up page when you intend to create one. Inspector authorization confirms the signed-in account and organization before the code is entered. The final review shows the requesting app, request time, available city and IP information, selected organization, and active projects. Approve only when those details match the Inspector request. Dashboard access tokens are distinct from credentials intended for customer integrations. Never copy a dashboard token into an integration.

​

Integration credentials

Each credential kind has a distinct prefix and permissions. Client-token access is constrained by rules such as allowedActions, recipient policy, origins, per-minute rate limits, daily maximums, and enabled state. See Authentication for the complete boundary and scope list. The MCP endpoint accepts the same credentials. Project tokens require the mcp scope; client tokens require the mcp allowed action. Every tool then passes through the ordinary Messaging API authorization checks.

​

Webhook integrity

Native webhook deliveries include timestamped HMAC signature headers; Meta-compatible deliveries use Meta-compatible signature headers. Verify against the raw request body before parsing it, reject stale timestamps, and compare signatures in constant time. See Webhooks for the exact headers and algorithms.

​

Operational controls

• Keep organization keys and project tokens on trusted servers.
• Grant the smallest scope set required by a workload.
• Prefer project tokens when an integration belongs to one project.
• Use client tokens for browser/mobile flows and set narrow actions, origins, recipients, and limits.
• Revoke or rotate a credential immediately when exposure is suspected.
• Use Audit Logs to inspect actors, actions, resources, results, source, IP, and changed fields.

For security disclosures or current compliance material, use polymorfa.com/security or email security@polymorfa.com.

​

Where to go next