Developer console sign-in

The developer console at developers.wasync.app holds API keys that can read and send your customers' WhatsApp messages, so its sign-in is held to a higher bar than a typical dashboard: a choice of sign-in methods, a mandatory second step, and a re-confirmation before anything sensitive happens.

Three ways to sign in

• Password — your email and password. Passwords must be 12–128 characters; we do not enforce upper/lower/symbol rules, and we never force a periodic reset. Every password is checked against a breach database when you set it — if it has appeared in a known breach, we refuse it and ask for a different one.
• Email code — enter your email and we send a 6-digit code. It is valid for 10 minutes, works once, and is invalidated after 5 wrong guesses.
• Passkey — a single "Continue with passkey" button. Passkeys use Face ID, Touch ID, Windows Hello or a hardware key, never leave your device, and cannot be phished or reused on another site.

Two-step sign-in

A password or an email code proves you know something; it does not prove the device is yours. So on top of one of the three methods above, most accounts also confirm a second step:

• Passkey — recommended. Because a passkey already required your device and your face, fingerprint or PIN, signing in with a passkey satisfies both the first and second step at once. Signing in with a password or an email code still asks for the second step separately.
• Authenticator app — any standard TOTP app (Google Authenticator, 1Password, Authy, etc.). Scan the QR code once to enrol; after that it asks for the 6-digit code it shows.
• Recovery codes — ten single-use codes, shown exactly once when you set up two-step sign-in. Store them somewhere safe. Each one works instead of a passkey or authenticator code, and using one does not disable the others.

What's mandatory, and when

• New accounts must set up a second step right after creating the account. You can put it off once; after that the console will ask again before letting you continue.
• Existing accounts get a 14-day banner asking them to set it up voluntarily; after those 14 days it becomes mandatory, the same as a new account.
• Admin accounts have no grace period — a second step is required from the moment this changed.

Devices and sessions

Signing in creates a session tied to your browser, not a token you copy around. By default a session is good for 12 hours of inactivity or 24 hours total, whichever comes first. Checking Keep me signed in for 30 days extends that to 30 days total, with a 7-day inactivity limit.

Under Security → Devices you can see every signed-in session — browser, approximate location and last-seen time — and sign any of them out, including the one you are currently using. When we notice a sign-in from a device we have not seen before, we email you with the device, approximate location and time, and a link to sign it out if it was not you.

Activity log

Security → Activity shows the last events on your account: sign-ins, sign-outs, password and two-step changes, API key creation, and similar. We keep this history for 12 months. It is there so that if something looks wrong, you can see exactly what happened and when, without having to ask us.

Confirming it's you again

A handful of actions are sensitive enough that the console asks you to confirm your second step again, even if you are already signed in — this matters if your second step was verified more than five minutes ago:

• Creating or revoking an API key
• Rotating a webhook secret
• Deleting a WhatsApp connection or closing a workspace
• Turning off a passkey or authenticator app, or regenerating your recovery codes
• For account admins: extending a licence or changing a partner's status

When one of these is triggered, a "Confirm it's you" dialog appears asking for your passkey, authenticator code or a recovery code. Once confirmed, the action goes through and the confirmation is good for a few more minutes.

Repeated failed attempts

A few wrong passwords in a row bring up a Cloudflare Turnstile challenge on the sign-in form — the same kind of check you see on many sites, not a code sent anywhere. Ten wrong passwords within 15 minutes apply a 15-minute temporary lock to the account, and we email the owner when that happens. The lock only affects password sign-in — you can still sign in with a passkey or an email code while it is active, so a lock can never be used to keep you out of your own account.

What we never do

• We never send a sign-in code or a password reset by SMS.
• We never put a one-time code or any secret in the subject line of an email — it only ever appears in the body, so it cannot leak through a notification preview or a mail client's list view.

Recovering access

If you lose your passkey or authenticator device, use one of your ten recovery codes to sign in and set up a new second-factor device from Security. If you have also lost your recovery codes, there is no self-service recovery for two-step sign-in by design — the whole point is that it cannot be bypassed by anyone who only has your email. Contact us in writing at [email protected] and we will verify your identity before restoring access.