# Security Sign-in options, active sessions, the organization audit log, API keys, and connected apps. Canonical: https://easerix.com/docs/platform/security You sign in once with a password or an emailed magic link and that session works across every tool. From account.easerix.com you can review and revoke active sessions, manage API keys and connected apps, and — as an owner or admin — read an audit log of everything done in your organization. ## Password and magic link Both sign-in methods live at [login.easerix.com](https://login.easerix.com): - **Magic link** — enter your email and click the link you receive. Accounts created this way don't need a password at all. - **Password** — set or change it at [account.easerix.com](https://account.easerix.com) → **Security & sessions**. New passwords must be at least 8 characters. If your account is magic-link only, leave the current-password field empty when setting your first password. ## Active sessions **Security & sessions** lists every device where you're signed in — the platform and browser, when it signed in, and which session is newest. Clicking **Revoke** next to a session signs that device out within minutes. If you see a device you don't recognize, revoke it and change your password. ## The organization audit log Owners and admins see an **Audit log** page under each organization: the last 100 actions across every Easerix tool in that organization, filterable by tool. Each entry names the action and when it happened; actions taken by a credential rather than a browser session carry a badge — **via API key**, **via connected app**, **via CLI**, or **automatic**. What it records: | Area | Events | |---|---| | Organization | created, profile updated, deleted | | Membership | joined, joined automatically by email domain, left, member removed, role changed | | Invitations | invitation sent, invite link created, invitation revoked | | Teams | created, updated, deleted, team member added/removed | | Access | tool access changed | | Credentials | API key created/revoked, app authorized/disconnected | | Domains | claimed, verified, joining mode changed, removed | | Product data | deletions (links, forms, documents, templates, clients, projects, issues, pages), sharing/visibility changes, and exports of links or click logs | The product-data list is deliberately narrow: what was destroyed, what was shared more widely, and what left the platform. ## API keys - **Personal keys** — [account.easerix.com](https://account.easerix.com) → **API keys**. - **Organization keys** — under the organization → **API keys** (owners and admins). Key creation and revocation are audit-logged, and anything a key does shows up in the audit log tagged *via API key*. Keys deliberately can't manage your identity: account deletion, password changes, sessions, and key management require a full browser session, so a leaked key can't lock you out or mint more keys. ## Connected apps **Connected apps** lists the apps and agents you've authorized through Easerix sign-in — an MCP client, the CLI. Each connection is bound to one workspace, and you can disconnect any of them at any time. ## Deleting your account At the bottom of **Security & sessions**, the danger zone. Deleting your account permanently removes your account, your personal workspace, and all sessions — there is no undo. Organizations you solely own must be transferred or deleted first. ## Frequently asked questions ### I forgot my password — what now? Sign in with a magic link at [login.easerix.com](https://login.easerix.com), then set a new password under **Security & sessions**. ### Who can read the audit log? Organization owners and admins. There is no audit log for a personal workspace — it has no members to audit. ### Do regular members' actions appear in the audit log? Yes — the log covers the recorded actions of everyone in the organization, whoever performed them and however they authenticated. ### Does revoking a session sign the device out instantly? Within minutes — the session can no longer renew itself, so the device signs out as soon as its current short-lived token runs out.