Accounts, team and security

Sign up #

Enter your email address on the sign-up page. We send a link; the person who opens it chooses the password, so whoever controls the inbox owns the account and nobody can claim an address in advance. The link works once, for 24 hours. Asking again within 10 minutes sends nothing new: the first link still works.

Before the console lets you manage a workspace you set up an authenticator app: scan the QR code (or type the key by hand), enter a six-digit code, and save the ten recovery codes it gives you. Each recovery code (XXXX-XXXX) works once.

The sign-up, password-reset and, after a few failed attempts, sign-in forms run a short BlockAlt browser check (a proof of work, the same technology that protects your sites). It usually takes well under a second.

Forgot your password? "Forgot password?" on the sign-in page emails a reset link (one hour; your authenticator or a recovery code is still needed). An address gets at most one such email every 10 minutes and five a day; past that, a request from a browser and network you signed in from in the last 30 days still gets its link.

Second factor #

• Authenticator app (TOTP) is required. Replacing it needs a current code or a recovery code, signs out every other session and issues new recovery codes.
• Passkeys are optional: add one in Security settings and use it instead of a six-digit code at sign-in and when the console asks you to confirm a change. Passkeys must verify you (fingerprint, face or PIN) on the device. Your authenticator and recovery codes keep working.
• Recovery codes: Security settings shows how many are left and creates new ones (the old ones stop working). Each use is announced by email with the number left.
• Wrong codes: after 5 wrong codes in a row, codes are not accepted for 15 minutes (doubling up to a day) and you get an email. Someone who enters wrong codes after your correct password knows your password: reset it.

Sessions #

A console session ends after 12 hours without activity and after 7 days in any case. The session cookie is HttpOnly, SameSite=Strict, Secure and __Host- prefixed. Security settings lists your sessions (browser and system family, sign-in time, last activity; no IP address) and ends any of them, or all of them.

Confirming changes. Changing your password or email, authenticator, recovery codes or passkeys, creating or revoking API keys, inviting people, changing roles, removing members, transferring ownership and deleting the account or workspace need a second factor entered in the last 15 minutes. So do creating or revoking a site's server keys, deleting a site, pausing or locking down protection and adding or deleting a notification destination. The console asks for a code or a passkey when needed.

Email notices #

You get an email when your password is changed or reset, your email address changes (the old address gets a link to undo it for 7 days, which a later change of address does not cancel; if the new address already has an account, only that address is told, so the form never reveals who has one; undoing the change also signs out every session, removes the password, which you set again from a link sent to the restored address, removes the recovery codes, passkeys, API keys, notification destinations and pending invitations added since the oldest session then signed in began, and names anyone who joined through an invitation sent meanwhile), two-factor authentication is turned on or replaced, a recovery code is used, a passkey is added or removed, second-factor checks are paused, and when your account is signed in from a browser or network it has not used in the last 30 days. Workspace owners are told about new members, role changes, ownership transfers, API keys and DNS records that disappear. These notices cannot be turned off.

Roles and team #

• Workspace name: the owner renames the workspace in the Team page.
• Invitations are valid for 7 days. The invitee creates an account or signs in with the invited address, on any device: pending invitations are offered after sign-in. Owners see pending invitations, resend them (a new link) or revoke them.
• Leaving: admins and members can leave a workspace. The owner transfers ownership first.
• Management API keys follow their creator: when the person who created a key leaves, is removed, becomes a member or deletes their account, the keys they created are revoked (they saw the secrets). The notification destinations they added are switched off when they leave, are removed or delete their account; an owner or admin can check them and switch them on again.
• Ownership transfer: the owner can make an admin who has set up two-factor authentication the owner; the previous owner stays as an admin and both get an email.

Audit log #

The audit log shows who did what (the member's email, or the API key's name), with readable descriptions, filters by kind of change and by person, and older pages on request. People who left the workspace appear as "Former member" and deleted accounts as "Deleted account", so the log never shows someone's later address; an invitation shows the invited address only while it is pending. The log also records the sign-ins, failed sign-ins and wrong second-factor codes of the account that created the workspace, while that account owns it, never with an IP address.

Limits #

A request over a limit gets 409 quota_exceeded or 429 rate_limited with a message naming the limit. Write to support@blockalt.click if you need more.

Export and deletion #

• Export: owners and admins download the workspace as JSON from the Team page: sites, settings history, hostnames, server-key and API-key metadata, members, invitations, notification endpoints (without URLs or secrets), usage, ledger, top-ups and the audit log. No secret, hash or webhook URL is included. Long histories keep their newest rows (the last 100 settings versions per site, 100,000 ledger rows, 20,000 audit events); the truncated field names any list that was cut, and the full records are available on request.
• Delete the workspace: the owner types the workspace name and confirms with the emailed link. Every member loses access, every server and API key is revoked, notification endpoints are deleted and the sites stop being protected (siteverify answers invalid_secret): remove BlockAlt from your pages and backend first. Your account stays; to start a new workspace of your own, delete the account and sign up again with the same address. A workspace with prepaid credit left, or with a top-up that is not settled yet (still payable, partly paid or still being credited; up to two days), is not deleted: ask us for a refund first, or wait for the payment to complete or expire.
• Delete your account from the Account page, confirmed by email. If you own a workspace with other members, transfer its ownership first; a workspace you own alone is deleted with the account. Your email address, password, authenticator, passkeys and sessions are removed.

Payment, usage and audit records are kept.

Domain checks #

Every verified hostname is checked again about once a day. If its _blockalt TXT record is missing, the owners get an email at once and two days before the deadline; after 7 days, and at least three checks that found the record missing, the hostname is marked unverified and its pages stop getting tokens. DNS errors that are not a clear answer (timeouts, server failures) never count.