Accounts & keys

Signing up#

Signup takes an email address and a password, nothing else. The address is an identifier, not a contact channel: we do not send mail to it, so it does not need to be real or reachable. It does need to be unique.

Signing in from the desk sets a session cookie valid for 30 days. Signing out deletes the session on our side, not just in your browser.

Recovery#

There is none, by design. Recovery means proving who you are, and we have nothing to check a claim against. Keep the password in a password manager.

API keys#

Issue a key under Keys in the desk, or with POST /v1/keys. Give each program its own named key so you can revoke one without touching the rest.

• Keys start with outis_ and are sent as Authorization: Bearer <key>.
• Every key has full access to the account — balance, purchases, DNS, servers. There are no scopes yet. Give a key only to software you would trust with the balance.
• Keys are stored encrypted, so the desk can reveal one again. Only a hash is used to authenticate.
• Deleting a key revokes it immediately.

Each key records when it was last used. Nothing else about the call is kept.

Default SSH key#

Save a public key on the account with PATCH /v1/me and {"defaultSshKey": "ssh-ed25519 …"}. See Servers.