Signing In and Account Security

Last updated: 12 November 2026

How people sign in

Readers, members and authors sign in with a one-time code sent to their email address. There is no password to steal or reuse. A code works once and expires after 10 minutes.

Passkeys for administrators

Administrating the platform or an installation can be done with a passkey: a key held by your phone, computer or security key, which unlocks it with your fingerprint, face or PIN. A passkey belongs to one address and works only there, so a look-alike site cannot use it. That is why it resists phishing, which an emailed code does not.

The first passkey is added through a single-use link, never from an email-code session alone, so someone who has broken into an inbox cannot add their own key. A person who already holds a key cannot issue a link for themselves; recovery comes from a platform administrator.

An installation can require passkeys for its administration. Its administrators then cannot sign in with an email code, and sensitive actions, such as changing who has access or where data goes, ask for the passkey again.

Platform administration accepts passkeys only. For installations' administration, passkeys are being introduced: until an installation requires them, its administrators can still sign in with an email code.

Sessions

A session ends when it has not been used for a while, and in any case after a fixed time:

Signing out ends it at once on the server. The session cookie cannot be read by scripts on the page and belongs to one address only.

Reporting a vulnerability

See Coordinated Vulnerability Disclosure, or write to security@lera.link. Our security contact is also published at /.well-known/security.txt on every LeraLink address.