Account security
Two-factor sign-in for the dashboard with an authenticator app or a passkey, recovery codes, the second check before sensitive changes, and signing out other browsers.
The dashboard signs you in with a link sent to your inbox, or with Google or GitHub. Two-factor sign-in adds a second step, so someone who gets into your email still can't reach your keys. Turn it on from the Security page.
Two-factor protects the dashboard. API calls keep authenticating with your key alone, so nothing changes for your servers. See Authentication.
Ways to prove it's you
| Way | What it is | At sign-in |
|---|---|---|
| Authenticator app | A six-digit code from 1Password, Google Authenticator, Authy or any TOTP app, new every 30 seconds. | Type the code. |
| Passkey | Your fingerprint, face or screen lock, a phone nearby, or a security key. | Confirm on the device. |
| Recovery code | Ten single-use codes, given when you add your first way. | Type one; it stops working after. |
Turn on either an authenticator app or a passkey, or both. Recovery codes come with the first one. They are shown once, so download or copy them and keep them away from your phone. Make new codes on the Security page replaces the whole set.
Signing in
After the email link, or Google or GitHub, the dashboard asks for the second step. A ticket for that step lasts five minutes. Tick Don't ask again on this browser for 30 days to skip it in that browser for 30 days. The browser keeps the remembered token in an httpOnly cookie.
A passkey also works on its own: Sign in with a passkey on the sign-in page needs no email, because the device has already checked who is holding it.
Wrong codes
Five wrong codes in 15 minutes pause the second step for 15 minutes, and we email you that it happened. Each code from the authenticator app works once, so a code someone saw over your shoulder is already spent.
Before sensitive changes
With two-factor on, these actions ask for the second step again, at most once every 15 minutes:
- creating, rotating or revoking an API key
- changing your plan's overage cap, or cancelling the plan
- allowing an app to connect, such as Claude through MCP
- turning off two-factor, removing a passkey, or making new recovery codes
The dashboard opens a small "Confirm it's you" window, then carries on with the action you started.
Emails we send
We email the account's address whenever its security changes, with the browser and address it came from:
- two-factor turned on or off, and a way added or removed
- new recovery codes made, or one used to sign in
- a sign-in from a browser the account hasn't used before
- the second step paused after wrong codes
If one of these wasn't you, open the Security page and sign out every other browser, then write to support@flightbyte.dev.
Signed-in browsers
The Security page lists every browser signed in to your account, with its address and when it was last active. Sign out one at a time, or every browser except the one you're using. A dashboard session lasts 30 days from its last use.
Lost every way in
Use a recovery code. If those are gone too, write to support@flightbyte.dev from the account's email address. We confirm it's you before turning two-factor off. Turning it off signs out every browser, and the next sign-in needs only your inbox. Add a new way right after.
Authentication and quotas
The API key header, the quota windows on every key, watched-flight limits, and what a 429 or a 402 looks like.
MCP server
Live flight status and flight webhooks as tools for your AI assistant. Add FlightByte to Claude in one click, or connect Claude Code, Cursor, VS Code and any MCP client.