Security
post.buzz supports several sign-in methods and gives you visibility into the sessions and credentials that can access your account. This page covers how to harden your sign-in and review active access.
Sign-in methods
| Method | Notes |
|---|---|
| Email & password | 8–128 character passwords; optional email verification. |
| OAuth; trusted for same-email account linking. | |
| Facebook Login | OAuth (separate consumer app from Facebook Pages). |
| Anonymous | Temporary sessions; upgrade to a full account to keep your data. |
Email verification
When you sign up by email, we send a signed verification link that expires after one hour. Until verified, your account still works — we'll remind you. Request a new link from the in-app banner if the old one lapses.
Password reset links are also time-limited (one hour).
Active sessions
You can review the devices currently signed in to your account and revoke any you don't recognize. Revoking ends that session immediately.
API key security
API keys are a form of credential — anyone with a key can act as you through the REST API. Keep keys in a secret manager or environment variables, rotate them periodically, and revoke unused keys from API key settings. Keys are stored only as a hash; they can't be recovered if lost.
Account linking
If you've forgotten which provider you used to sign up, signing in with a different provider that shares the same email address may auto-link (for trusted providers like Google) rather than creating a duplicate. Check your profile to see which providers are linked.
Related
- Profile — identity details.
- API keys — programmatic credentials.
- Authentication (API) — how keys are validated.