Skip to main content
Polymorfa supports passwordless email OTP, passkeys, TOTP with recovery, configured social providers, and device and session management. The sign-in page shows only providers that are available for the current deployment.
Not from the sign-in page. Social sign-in is for an existing account; use the sign-up page when you intend to create an account with a configured provider.
Confirm the signed-in account, select the intended organization, and compare the device code. Before approving, review the requesting app, request time, available city and IP information, organization, and active projects. Deny the request if any detail is unexpected.
No. Organization keys, project tokens, and client tokens use Polymorfa’s versioned service-token format. Dashboard sessions use JWTs separately.
Use an organization key for organization-wide server work, a project token for one project’s server work, and a client token for short-lived session-specific browser/mobile access. See Authentication.
Create and deploy a replacement, then revoke the exposed credential. Inspect Audit Logs for unexpected actions and narrow the replacement’s scopes.
Verify the documented HMAC signature against the raw body, check its timestamp, and use a constant-time comparison. Native and Meta-compatible deliveries use different headers; see Webhooks.
Email security@polymorfa.com with a minimal reproduction. Current disclosure and compliance information lives at polymorfa.com/security.