Security

• raw keys are shown only once
• only key hashes are stored
• safe key prefixes are shown in Delivery Keys
• revoked keys stop accepting delivery requests

Auth URLs must include one non-empty token query parameter and may include one redirect_url parameter generated by Own Auth. Relative redirects are accepted. Absolute redirects must match a configured website root or app scheme. Protocol-relative and unconfigured redirects are rejected. My URLs mode accepts configured website or app URL roots. Own Auth hosted mode replaces the destination with the app's fixed go.own-auth.com bridge URL and preserves the validated redirect_url.

Use Delivery logs to understand the safe status and error information available when debugging authentication email delivery. Open the selected app's Logs tab to inspect its events.

• no auth URLs
• no raw tokens
• no raw delivery keys
• no passwords

Delivery requests are limited by delivery key, recipient, and app daily limit. Limits reduce abuse and stop one app from affecting every other app.