Account Security
ChatBotKit includes several protections for your account. This page explains what each one does and how to use it.
The Security Page
To open the Security page, select your profile icon to open the account menu and choose Security. The page has five tabs:
- Sign-in & passkeys: add, rename and remove passkeys
- Sessions: see where your account is signed in and sign out browsers and devices
- Secrets: review the secrets of the account you are viewing and clear their stored credentials
- Tokens: review and revoke API tokens
- Access: revoke access in one step when you suspect that a token or credential has leaked
The Secrets and Tokens tabs list names and details only. Stored values are never shown.
Passkeys
A passkey lets you prove it is you with Touch ID, Windows Hello, your phone or a security key. Once your account has a passkey, it is required to sign in and to confirm sensitive actions.
Adding a Passkey
- On the Security page, open the Sign-in & passkeys tab and select Add passkey.
- Enter a name that helps you recognize the passkey, for example the device it is on, and select Continue.
- Follow your browser's prompt to create the passkey.
- If this is the first passkey on your account, we email a code to your account's email address. Enter it in the Confirm passkey dialog and select Add passkey. The code expires after 5 minutes and works only once.
The list shows when each passkey was added and when it was last used. Use Rename to change a passkey's name and Remove to delete it. Adding another passkey, or removing one, asks you to verify with a passkey first. We email you whenever a passkey is added to or removed from your account.
Signing In with a Passkey
When your account has a passkey, signing in takes two steps:
- On the sign-in page, select Have a passkey? Verify it first and confirm with your passkey.
- Continue with the sign-in method you normally use, such as an email code, Google, GitHub or Microsoft.
A sign-in without the passkey step is refused. Passkey sign-in is available on the main ChatBotKit site, so sign in there once your account has a passkey.
Confirming Sensitive Actions
When your account has a passkey, you are asked to verify with it before you:
- create an API token
- revoke all access tokens
- use Panic: revoke account access
- add another passkey or remove one
Sessions
The Sessions tab lists the browsers and devices that are signed in to your account, with the site, IP address and when each one was last active. The browser you are using is tagged current.
- Select Sign out next to a session you do not recognize to end it.
- Select Sign out all other sessions to sign out everywhere except the browser you are using.
Sign-in Notifications
We email you every time your account is signed in to. The email says whether the sign-in came from a new device or network and includes the time, the sign-in method, the approximate location, the browser and a partly hidden IP address.
If you did not sign in, select Review your sessions in the email, sign out that session on the Security page straight away and contact our support team.
Sign-in History
Every sign-in is also recorded in your audit log. Open Audit in the dashboard menu and look for entries tagged LOGIN. Select an entry to see its details, including the IP address and browser. Passkey activity is recorded as well, with the tags PASSKEY_ADDED, PASSKEY_REMOVED, PASSKEY_USED and PASSKEY_FAILED. See Audit for more about audit logs.
API Tokens
An API token is shown only once, when you create it. Copy it then and store it securely. If you lose it, create a new one. See Tokens for details.
The Tokens tab on the Security page lists your API tokens. Select Revoke next to a token to delete it. Applications that use a revoked token can no longer access your account.
Revoking Access
The Access tab has two actions for when you suspect that a token or credential has leaked.
Revoke all access tokens invalidates the signed access tokens issued for your account. Widgets, live chats, MCP and Pipedream connections may need to reconnect. Your API tokens and sessions are not affected.
Panic: revoke account access is for when you think your account may be compromised. In one step it:
- revokes all signed access tokens, so widgets, live chats and integrations may need to reconnect
- deletes all API tokens
- signs out all other sessions
- clears stored shared credentials and asks providers to revoke them where they support it
To confirm, type REVOKE and select Revoke account access. Tick Also sign out this session to sign out the browser you are using as well. Panic cannot be undone.
Some access is outside its reach: access a provider has already issued, MCP authorizations and personal or contact credentials may remain. Revoke those separately.
Stored Credentials Stay Hidden
After you save a credential, ChatBotKit does not show it again. You can see that one is stored and replace or clear it.
- Secrets: a secret's page tells you whether a value is stored but never shows it. Choose Keep stored value, Replace stored value or Clear stored value. A secret's stored configuration works the same way.
- Integrations: stored tokens, keys and secrets of integrations such as Slack, Discord, Telegram, WhatsApp and GitHub are shown masked. Saving the settings without entering a new value keeps the stored credential. Values you copy into the other service, such as verify tokens and webhook secrets, stay visible.
- API tokens: shown only once, when you create them.
To clear the stored credentials of a shared secret without deleting its configuration, open the Secrets tab on the Security page and select Clear stored credentials. Integrations that use the secret may stop working until you enter new credentials. Personal connections are managed per contact.
Secrets Only Go Where They Belong
A secret is set up for a specific service, through its configuration or the template it comes from. When an ability, integration or request uses the secret, ChatBotKit sends the credential only to that service. A request to any other address is refused and does not receive the credential.
To point a secret that holds credentials at a different service or endpoint, enter the credentials again: clear the stored credentials first, or create a new secret.