Keep your account secure

Sign-in

• Add a second factor in Settings → Security: a passkey (Face ID, Touch ID, Windows Hello) or an authenticator app. Every new sign-in then asks for it.
• Owners can require it for every member in Settings → Members. Members without one must set it up before they can continue.
• Remove people who leave in Settings → Members. Tokens they created keep working until you delete them, so review those too.

Keys and tokens

Warsita stores keys and tokens only as hashes; nobody can read them back, including us.

• Keep session API keys (wsk_…) and personal access tokens (wsp_…) on your server, never in a browser, mobile app or public repository.
• Give each app its own session or token, so you can cut one off without touching the others.
• Review Settings → Connected Apps for AI apps connected through the MCP server, and disconnect the ones you no longer use.

If a key or token leaked

Act at once; each step takes effect immediately:

1. Session API key: open the session and click Regenerate next to the key. Update your app with the new one.
2. Personal access token: delete it in Settings → Access Tokens and create a new one.
3. Webhook secret: click Rotate on the session's Webhook tab, and update your server.
4. Connected app: click Disconnect in Settings → Connected Apps.

Then check the session's Messages tab for messages you did not send, and tell us at hello@warsita.com.

Lost your phone or passkey

If you added both a passkey and an authenticator app, use the other one. If you cannot sign in at all, email hello@warsita.com from your account's address. We confirm it is you, usually with your workspace owner, and then remove your second factor so you can set up a new one. For your safety, this is never done on the strength of an email alone.