Account and workspace settings
Secure your account
Understand password, Google, sessions, linking, and workspace access controls.
Avara uses Better Auth for web identity and server-validated workspace membership for data access.
Sign-in methods
Email and password accounts use a securely hashed password. Google sign-in is available when the provider is configured. An existing password account can link to Google only when verified-email and matching-address checks pass.
Google login does not implicitly create an uninvited account while public signup is paused. Invitation-based Google creation requires a valid invitation for the verified provider email.
Sessions and access
Web sessions use an HttpOnly cookie. Native sessions use the supported bearer flow. Every protected product request resolves the account, active membership, and workspace scope before reading or mutating data.
Enable MFA for an additional sign-in factor. If you suspect a public share or calendar-feed token was exposed, disable or regenerate that token from its management surface.