Account & security
Your Requestarium account holds your workspaces, collections, and environments. The desktop app, the web app, the editor extensions, and the CLI all sign in to the same account.
Sign in
Open the app and choose one of the sign-in options:
| Option | How it works |
|---|---|
| Google, GitHub, LinkedIn, Facebook | Click Continue with … and approve access with the provider. The email is already verified by the provider. |
| Email and password | Create an account with your email and a password. We send a 6-digit code to your email; enter it to activate the account. |
If you sign up with email and don't enter the code, the next sign-in asks you to confirm your email and sends a new code.
Two-factor authentication
Two-factor authentication adds a code from an authenticator app (Google Authenticator, 1Password, Authy, and others) to every sign-in.
To turn it on:
- Open Settings → Security.
- Scan the QR code with your authenticator app. If you can't scan it, enter the key shown under the code.
- Enter the 6-digit code from the app to confirm.
- Save the recovery codes somewhere safe. They are shown only once.
When you sign in, Requestarium asks for the current 6-digit code after your password. If you lose your phone, choose Use a recovery code and enter one of the saved codes. Each recovery code works once.
API tokens
API tokens let the CLI, CI jobs, the browser extension, and editor plugins act as you in an organization.
- Open Settings → API tokens.
- Enter a name, for example
CI pipeline, and choose when the token expires. - Copy the token. It starts with
trt_and is shown only once.
Revoke a token you no longer use from the same page. The VS Code extension and the JetBrains plugin can also create a token for you when you click Sign in in the editor; those tokens show up in the same list.
Good practice
- Turn on two-factor authentication for accounts that can see production environments.
- Give each machine or pipeline its own token, so you can revoke one without breaking the others.
- Keep secrets in environment variables, not in request bodies or headers. See Environments.