Skip to main content

Security

post.buzz supports several sign-in methods and gives you control over the credentials that can access your account. This page covers how sign-in works and how to harden it.

Sign-in methods​

MethodNotes
Email & password8–128 character passwords; username also accepted as identifier.
GoogleOAuth; trusted for same-email account linking.
Facebook LoginOAuth consumer app (separate from Facebook Pages connections).
AnonymousTemporary sessions; upgrade to a full account to keep your data.

Email verification​

When you sign up by email, we send a verification link that expires after one hour. Verification is soft — your account works before it, with a reminder banner and a resend button (60-second cooldown). Verifying signs you straight back in.

Password reset links are also time-limited (one hour) and each works once.

Sessions​

Your session lives in a signed, HttpOnly cookie. Two practical facts:

  • Changing your password revokes every other session — the fastest way to eject a device or app you're unsure about.
  • Signing out ends the current session and resets the client state.

Account linking​

If you've forgotten which provider you used to sign up, signing in with a different provider that shares the same email may auto-link (for trusted providers like Google and Facebook) rather than creating a duplicate. Linking never overrides an unverified email/password account — that's a takeover guard. Check your profile to see which methods are active.

API key security​

API keys are a form of credential — anyone with a key can act as you through the REST API. Keep keys in a secret manager or environment variables, rotate them periodically, and revoke unused keys from API key settings. Keys are stored only as a hash; they can't be recovered if lost.

Data protection notes​

  • OAuth tokens for connected social accounts are encrypted at rest and revocable per channel (disconnect) at any time.
  • We never store your social-network passwords — connections use each platform's official OAuth flow (Bluesky uses an app password; Telegram a bot token).