Skip to main content
Use Security & API for active access and Account settings for identity, export, sign-out, and account lifecycle controls.

​
Signed-in devices

The device list marks the current browser session and shows when every session was last seen. Revoke any session you do not recognise. Revocation ends that session without affecting the current browser or personal API keys.

​
Create a personal API key

Select New API key, then provide:
  1. a descriptive key name;
  2. the one workspace the key can access;
  3. the minimum required permissions; and
  4. an expiry of 7, 30, or 90 days.
The key is displayed once after creation. Copy it directly into the tool’s secret store and do not place it in source code, screenshots, issue reports, or command output. Revoking a key takes effect immediately. For bearer-token request syntax, see API authentication.

​
Account settings

The identity panel shows the display name, verified email, account ID, and current session ID returned by the identity provider. sndbox does not store a separate account password. The action panel provides direct access to:
  • Security & API;
  • a machine-readable account export; and
  • sign-out for the current browser only.
Account exports omit plaintext credentials, token hashes, protected-variable ciphertext, device keys, and raw webhook payloads. See Privacy and retention for the complete export schema and retention table.

​
Danger Zone

The Danger Zone contains actions that remove access immediately: Account deletion requires typing DELETE and can require fresh passkey or multi-factor authentication. It is refused while the account owns an organisation or is the sole human owner of an active service account. Required workspace audit and financial evidence can remain for their published retention periods.
Export any required account data and transfer organisation ownership before deleting the account. Deletion is not a substitute for revoking a single compromised session or API key.