Security

Your LaunchPulse account is the key to your analytics. Here’s what protects it and how to turn each piece on.

Everything below lives in your account settings.

Signing in

Your baseline login is email and password. Passwords are hashed with argon2id — they are never stored in a form anyone can read, including us.

You may also see:

• A Cloudflare Turnstile bot check on the login form, when it’s enabled.
• “Sign in with a passkey” — skips the password entirely, if you’ve registered one.
• OAuth with Google and GitHub, when configured.

If you have MFA enrolled, you’ll be asked for a second factor after your password: either a 6-digit code from your authenticator app or one of your recovery codes.

Authenticator app (TOTP)

Enable it and LaunchPulse shows you a QR code plus a manual base32 key, in case your app can’t scan. Add it to your authenticator, then confirm with a 6-digit code to finish enrolling.

The parameters, if you need them for a manual setup or a self-hosted authenticator:

The ±1 step tolerance means a code from the adjacent 30-second window is still accepted, so a slightly drifted device clock won’t lock you out.

Two things worth knowing:

• Codes cannot be replayed. Once a code is used it’s rejected for the rest of its window, even though it’s still technically time-valid. If you fat-finger a login and retype the same code, wait for the next one.
• The secret is encrypted at rest.

Disabling TOTP requires a current code. You can’t turn off the second factor with just a session.

Recovery codes

When TOTP is on, a recovery codes card appears. It gives you 8 single-use codes, formatted xxxxx-xxxxx.

They’re shown once. There are Copy and Download buttons — Download gives you launchpulse-recovery-codes.txt. After you leave that screen, the card only tells you how many codes remain. It cannot show them again, because the codes are hashed, not stored in readable form.

Each code works exactly once. When you’re running low, regenerate — which requires a current TOTP code and replaces the whole set.

Put them somewhere you’ll actually find them. A password manager is the right answer. A screenshot in your downloads folder is not. These codes are your way back in if you lose your phone.

Passkeys

Add passkey runs your browser’s WebAuthn registration ceremony — Touch ID, Windows Hello, a hardware key, or your phone, depending on the device. Then you give it a nickname so you can tell your devices apart later.

The list shows each registered passkey with a Remove link.

Once registered, you can sign in with a passkey directly from the login page, no password typed.

Sessions

Sessions last 30 days and are sliding — every time you use the app the clock is refreshed, so an active account effectively stays signed in.

The session cookie is httpOnly (JavaScript can’t read it), SameSite=Lax, and Secure in production. Server-side, only a hash of the session token is stored, so a database read doesn’t hand anyone a working session.

Abuse limits: login attempts are rate-limited to roughly 10 per minute, and signups to about 5 per hour per IP.

What we recommend

Three steps, in order:

1. Enable TOTP. It’s the single biggest improvement, and it takes a minute.
2. Save your recovery codes in your password manager, right when they’re shown.
3. Add a passkey. After that, day-to-day sign-in is a fingerprint instead of a password plus a code.

MFA is not about your tracking keys

Worth stating plainly, because it confuses people: MFA protects your dashboard account. It has nothing to do with the keys your site uses to send events. Those are a separate system with separate rules.

Your public key is meant to be visible in your page source — that’s how browser tracking works, and a leaked public key doesn’t grant access to your data. Server-side keys are secrets and are handled differently.

• SDK reference — the browser key and how it’s used.
• Server-side events — server keys and how to keep them secret.

What’s next

• Account and billing — plan, trial, and email changes.
• Privacy — what LaunchPulse collects about your visitors.