Getting started
Create your workspace
Sign-up runs as a two-OTP registration challenge. Nothing is written to your workspace until both the email code and the phone code have been verified, which keeps a tenant from being created against an address or number the owner doesn't control.
How it works
- A registration challenge is created and holds the codes until both are verified
- Codes are HMAC-hashed at rest and compared with a timing-safe check, never stored in plain text
- Once both codes verify, the tenant and OWNER user are created in the same step
Good to know
- In development, OTP codes can surface in the API response for faster testing; production never returns codes
- Legacy single-step registration is intentionally disabled and returns a 410