Account security

What Webrizen SSO does to keep accounts safe, and the controls people and organizations have over their own security.

Built-in protections

Protection	Details
Password hashing	scrypt, a memory-hard algorithm. PINs use the same hashing
Breached passwords	Rejected using Have I Been Pwned (k-anonymity: only a hash prefix leaves the server)
Email verification	Required before password sign-in
Rate limiting	Global limits, plus stricter ones on sign-in (10/min), code sending (5/min) and PIN sign-in (10/min)
Lockouts	Two-factor: 5 wrong codes → 15 min. PIN: 5 wrong PINs → 15 min
One-time codes	Stored hashed, expire in 10 minutes, 5 attempts
Sessions	HTTP-only cookies, 30-day lifetime, refreshed daily while in use
OIDC	Authorization code + PKCE (S256), exact redirect URI matching, RS256-signed ID tokens
Private keys	Signing keys are stored encrypted with `BETTER_AUTH_SECRET`

Sessions and devices

Security → Where you're signed in lists every active session with its device, IP address and last activity. People can sign out a single device or Sign out all others. Changing or resetting a password can sign out other devices automatically.

Session tokens never reach the browser's JavaScript: revoking a session happens on the server by session ID.

Connected apps

Security → Connected apps lists third-party applications a person has allowed, with the scopes they granted. Revoking removes the consent; the app must ask again next time.

Audit log

Each organization has an audit log (Organization → Audit log) recording who did what, when, and from which device and IP address. It's visible to roles with the audit:read permission. Platform admins also get a platform-wide log under Platform → Audit log.

Recorded events include:

sign-ins and sign-ups
password changes and resets
2FA, passkey and PIN changes
invitations, joins, removals and role changes
team and custom-role changes
organization updates
app registration, secret rotation, enabling, disabling and deletion (platform log)
Directory API access and webhook endpoint changes (platform log)
user bans, unbans and platform-role changes (platform log)

Filter by person, action or target, and page back through older events.

Platform-level controls

Platform admins can ban a user (signing them out everywhere and blocking new sign-ins), revoke all of a user's sessions, and disable an application instantly. See Platform admin.

Your responsibilities in production

Keep BETTER_AUTH_SECRET secret and stable

It encrypts signing keys and signs session cookies. Leaking it compromises every session; changing it signs everyone out and makes stored signing keys unreadable (see Troubleshooting).

Serve only over HTTPS (Vercel does this automatically).
Use a dedicated email-sending domain with SPF and DKIM so codes don't land in spam.
Require two-factor for everyone with the owner or admin role.
Rotate an app's client secret right away if it may have leaked.