Threatless

Account & sessions

Email and Google sign-in, email confirmation, and session revocation.

Threatless accounts are personal. There is no team workspace yet — one user, one quota, many API keys.

Sign-up

Email and password

Register with name, email, and password. Threatless emails a confirmation link. You cannot sign in until the address is confirmed.

Google

If Google OAuth is enabled on the instance, Continue with Google starts /web/auth/google/start and returns through /web/auth/google/callback. Accounts created with Google cannot use password sign-in.

Sessions

A successful login issues:

  • A short-lived access JWT (15 minutes) stored in the token cookie on the web app
  • An httpOnly refresh token cookie on the API (/web/auth/refresh)

The frontend refreshes the access token in the background while you are active. Logging out clears both sides.

Connected sessions

GET /web/users/me/sessions lists active refresh sessions (device metadata, current session flag). You can:

  • DELETE /web/users/me/sessions/{sessionId} — revoke one device
  • DELETE /web/users/me/sessions — revoke every session

Use this if a laptop is lost or a token looks wrong.

Password reset

Request a reset from Forgot password. Threatless emails a one-time link. Completing it sets a new password and you can sign in again.

Profile

From Settings you can change your display name. Email is read-only. To delete the account, contact support.

Previous

Introduction

REST contract for scanning files and URLs with Threatless.

Next