Secure website sessions
NextAuth uses JWT sessions with the configured secret and account middleware protects `/account/*` routes.
Security
Account security
procod! keeps public pages, account sessions, linked devices, API keys, payments, and local code work separated by clear permissions.
Google sign-in
Google sign-in is hidden or marked unconfigured unless a usable client id and secret are present.
Email and password
Email login and registration call the configured authentication server. The website does not invent local-only users.
Device linking
Desktop device routes remain separate from public site routing and are used for scoped linked-device sessions.
API key lifecycle
Keys are scoped, rate limited, rotated or revoked through account actions, and secrets are revealed once.
Payments and account audit
Payment portal, invoices, spend exports, history deletion, and team changes are account actions with real server state.