> ## Documentation Index
> Fetch the complete documentation index at: https://docs.polymorfa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Common questions about Polymorfa authentication, credentials, and disclosures.

<AccordionGroup>
  <Accordion title="Which account authentication methods are available?">
    Polymorfa supports passwordless email OTP, passkeys, TOTP with recovery, configured social providers, and device and session management. The sign-in page shows only providers that are available for the current deployment.
  </Accordion>

  <Accordion title="Can social sign-in create a new account?">
    Not from the sign-in page. Social sign-in is for an existing account; use the
    sign-up page when you intend to create an account with a configured provider.
  </Accordion>

  <Accordion title="What should I check before authorizing Inspector?">
    Confirm the signed-in account, select the intended organization, and compare
    the device code. Before approving, review the requesting app, request time,
    available city and IP information, organization, and active projects. Deny
    the request if any detail is unexpected.
  </Accordion>

  <Accordion title="Are client tokens JWTs?">
    No. Organization keys, project tokens, and client tokens use Polymorfa's versioned service-token format. Dashboard sessions use JWTs separately.
  </Accordion>

  <Accordion title="Which credential should my integration use?">
    Use an organization key for organization-wide server work, a project token for one project's server work, and a client token for short-lived session-specific browser/mobile access. See [Authentication](/api/authentication).
  </Accordion>

  <Accordion title="How do I rotate a leaked credential?">
    Create and deploy a replacement, then revoke the exposed credential. Inspect [Audit Logs](/console/audit-logs) for unexpected actions and narrow the replacement's scopes.
  </Accordion>

  <Accordion title="How are webhook deliveries authenticated?">
    Verify the documented HMAC signature against the raw body, check its timestamp, and use a constant-time comparison. Native and Meta-compatible deliveries use different headers; see [Webhooks](/api/webhooks).
  </Accordion>

  <Accordion title="How do I report a security issue?">
    Email **[security@polymorfa.com](mailto:security@polymorfa.com)** with a minimal reproduction. Current disclosure and compliance information lives at [polymorfa.com/security](https://polymorfa.com/security).
  </Accordion>
</AccordionGroup>