Welcome back

or continue with email

Email

Argon2id, passkeys, two-factor and rotating sessions · How we protect you

Sign in

Your workspace,right where you left it.

Your password is checked against an Argon2id hash, then a 15-minute access token and a rotating refresh token keep you signed in — on every device you choose.

kodeo · authtls 1.3 · hsts · csp nonce

auth

you@team.dev

Sign in

argon2id m=19 MiB · t=2 · p=1

Your workspacesession · sealed

storefront signed in

Signed inPixel · Chrome

Password verified

argon2id · never stored in plain text

Access token 15:00

eyJhbGciOiJIUzI1.eyJzdWIiOiJ1Xz.Sfl3KxwRJ

Refreshrt·01rt·02rt·03

replay an old one → the session is revoked

Argon2id password hashing
Rotating refresh tokens, reuse detection
One-time codes, hashed at rest
Authenticator apps, passkeys and backup codes
Per-device sessions you can revoke
Rate limits, lockouts and a strict CSP