> ## Documentation Index
> Fetch the complete documentation index at: https://docs.polymorfa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Polymorfa authentication, credential, webhook, and operational security boundaries.

Polymorfa separates human Console sessions, server credentials, project credentials, and end-user client tokens. Each surface re-authorizes against live organization and project state.

## Account authentication

The Console supports passwordless email OTP, passkeys, TOTP with recovery,
configured social providers, session and device management, and the desktop
device-authorization flow. The sign-in page shows only authentication methods
enabled for Polymorfa.

Under **Account settings**, add and verify secondary email addresses, select a
primary sign-in address, or remove a non-primary address. Under
**Authentication**, manage passkeys, an authenticator app with recovery codes,
available social connections, browser sessions, Inspector sessions, and
command-line sessions. Revoking a session removes its account access.

Social sign-in and social account creation are separate actions. Signing in
with a provider does not create an account implicitly; use the sign-up page
when you intend to create one.

Inspector authorization confirms the signed-in account and organization before
the code is entered. The final review shows the requesting app, request time,
available city and IP information, selected organization, and active projects.
Approve only when those details match the Inspector request.

Dashboard access tokens are distinct from credentials intended for customer
integrations. Never copy a dashboard token into an integration.

## Integration credentials

| Credential       | Prefix      | Intended use                                                                                        |
| ---------------- | ----------- | --------------------------------------------------------------------------------------------------- |
| Organization key | `titan_`    | Server-to-server access across authorized organization resources.                                   |
| Project token    | `titan_pt_` | Server-to-server access confined to one project and its scopes.                                     |
| Client token     | `titan_ct_` | Short-lived browser/mobile access controlled by session, action, recipient, origin, and rate rules. |

Each credential kind has a distinct prefix and permissions. Client-token access
is constrained by rules such as
`allowedActions`, recipient policy, origins, per-minute rate limits, daily
maximums, and enabled state. See [Authentication](/api/authentication) for the
complete boundary and scope list.

The MCP endpoint accepts the same credentials. Project tokens require the `mcp` scope; client tokens require the `mcp` allowed action. Every tool then passes through the ordinary Messaging API authorization checks.

## Webhook integrity

Native webhook deliveries include timestamped HMAC signature headers; Meta-compatible deliveries use Meta-compatible signature headers. Verify against the raw request body before parsing it, reject stale timestamps, and compare signatures in constant time. See [Webhooks](/api/webhooks) for the exact headers and algorithms.

## Operational controls

* Keep organization keys and project tokens on trusted servers.
* Grant the smallest scope set required by a workload.
* Prefer project tokens when an integration belongs to one project.
* Use client tokens for browser/mobile flows and set narrow actions, origins, recipients, and limits.
* Revoke or rotate a credential immediately when exposure is suspected.
* Use Audit Logs to inspect actors, actions, resources, results, source, IP, and changed fields.

For security disclosures or current compliance material, use [polymorfa.com/security](https://polymorfa.com/security) or email **[security@polymorfa.com](mailto:security@polymorfa.com)**.

## Where to go next

<Columns cols={2}>
  <Card title="Authentication" icon="key" href="/api/authentication">
    Credential formats, scopes, and route boundaries.
  </Card>

  <Card title="Audit logs" icon="clipboard-list" href="/console/audit-logs">
    Inspect and export organization actions.
  </Card>
</Columns>