Authentication

User login

Sectora does not use passwords. Two login methods:

• Magic link — enter your email at /auth/login. We send a one-time link valid for 15 minutes. Clicking it logs you in. The link can be used once.
• Google OAuth— Sign in with Google. Maps the Google account's primary email to your Sectora account.

Both produce the same kind of session — a signed JWT in a Secure HttpOnly cookie, valid for 30 days, refreshed silently on every request. Log out anywhere clears all sessions for the account.

SSO (Enterprise plan)

On the Enterprise plan, all members of your organization must authenticate via your IdP. Sectora supports:

Configure at Settings → SSO. Provide your IdP's metadata URL (SAML) or issuer + client_id + client_secret (OIDC). Test the flow with the "Try login" button before enforcing org-wide.

Sessions + audit log

Settings → Account → Sessions shows every active session for your account (browser, IP, last seen). Revoke any session you don't recognise.

Settings → Audit Log shows every account-relevant action: login, logout, password-less sign-in via new device, API key generation, role change, scan triggers. Filterable by actor + action; exportable to CSV.

API keys (for automation)

For CI/CD pipelines, scripts, and integrations, use API keys instead of session cookies. Generate at Settings → API Keys → + New key.

Key scopes

Each key has an explicit scope set. Pick the minimum:

• scans:read — read scan results.
• scans:write — create + cancel scans.
• vulnerabilities:read — read findings.
• vulnerabilities:write — mark FP, change status, run verify-fix.
• shield:read — read Shield config + analytics.
• shield:write — modify Shield rules + virtual patches.
• admin — everything (Pro plan + above). Use sparingly.

Using a key

curl -H "Authorization: Bearer sect_live_..." \
  https://api.sectora.io/api/v1/scans

Keys are prefixed sect_live_ (production) or sect_test_ (sandbox/test mode — coming soon). The full key is shown only at creation time; afterwards only the last 4 chars are visible.

Key rotation

Best practice: rotate API keys every 90 days. Use Settings → API Keys → Rotate, which generates a new key and gives you a 7-day grace period where both old and new accept requests. Update your CI/CD secrets within the grace, then revoke the old.

Provider integrations (Sectora → your services)

Sectora needs to authenticate TO your providers for scan operations. Each provider connection is configured at Settings → Integrations and is org-scoped (shared across team members).

Source control (GitHub / GitLab / Bitbucket)

OAuth flow — click Connect → authorize on the provider. Sectora stores the access token + refresh token AES-256-encrypted at rest. Used to clone repos for SAST/SCA/Secrets scans and to post PR comments + check runs.

Ticket trackers (Jira / Linear / GitHub Issues)

OAuth or API token (provider-dependent). Used for auto-creating tickets from findings and bi-directional status sync (closing the ticket in Linear marks the finding resolved in Sectora).

AI proxy (Anthropic / OpenAI / Gemini)

For BYO-key AI Smart Triage. Set your provider API key under Settings → Integrations → AI. The bundled Gemini fallback ships with the trial so the feature works out of the box without this; bring your own key once you outgrow the included quota.

Cloud accounts (AWS / GCP / Azure)

For Attack Surface Management — discovers your public endpoints by querying provider APIs (EC2, ELB, Cloud Run, App Service, etc.). Read-only IAM role / service account. See ASM.

Webhooks (Sectora → your systems)

Outbound webhooks for findings, scan completion, Shield blocks. Configure at Settings → Webhooks. Every request is signed with HMAC-SHA256 over the body using your endpoint's signing secret:

X-Sectora-Signature: t=1716643200,v1=abc123...

Verify on your end using the same algorithm Stripe uses (timestamp prevents replay; we reject deliveries > 5 min old). Code samples for Node/Go/Python are in the integrations docs.

What's next

• Teams + Roles — RBAC + invite flow.
• Integrations — third-party service connections.
• API Reference — full endpoint list for your API keys.