Accounts and access
Three kinds of caller — a person, an integration, a site — and how each is identified.
A person
Signs in to wpocto.com with an email address and a password, or through a sign-in provider offered on the login page. Two-factor authentication with a time-based code and recovery codes can be enabled from the profile. The login, registration and password-reset forms carry a captcha.
What a signed-in person may do is decided by their role in the workspace — administrator, user or client. A client role is read-only and sees only the sites of the client accounts it is attached to. Roles and permissions lists what each role holds.
An integration
Calls the API with a workspace API key as a bearer token. The key is created and revoked by a workspace administrator under workspace settings, is shown once, and identifies the workspace, not a person. Everything an API call can read is scoped to that workspace.
A site
A managed site holds the workspace token, and the platform presents it on every call to the site; the site checks it and refuses anything else. When the site calls the platform, it identifies itself the same way, and the platform accepts it only as the site it is registered as in the workspace the token belongs to.
Since worker 2.3.0 the site also holds a credential of its own for the calls it makes, issued by the platform, and the instructions it accepts from the platform are signed and valid once. Connection describes the two directions.