Sign-in, passkeys and API keys

On the sign-in screen you can choose:

• Continue with Google, to use your Google account.
• Continue with email. We email you a sign-in link and a 6-digit code. Type the code in the window where you started, or use the link to sign in on that device. The code works for 5 minutes. If it doesn't arrive, check your spam folder or choose Send it again.
• Sign in with a passkey, once you've set one up.
• A password, under Other ways to sign in. Passwords need at least 10 characters. If you forget yours, sign in with an email code instead.

The sign-in screen marks the method you used last with Last used.

A passkey lets you sign in with your fingerprint, face or device PIN instead of waiting for an email.

1. Open the account menu at the top right and choose Account.
2. Next to Sign in faster, choose Add a passkey.
3. Follow your device's prompt.

After a few sign-ins with an email code, Obelisk also offers Set up a passkey right after you sign in. You can choose Not now. Next time, choose Sign in with a passkey on the sign-in screen.

You stay signed in on a device for 7 days from the last time you used Obelisk there, or until you sign out. When a session ends, Obelisk asks you to sign in again, and nothing you were doing is lost.

To sign out on the device you're using, open the account menu and choose Sign out, or choose Sign out on the Account page.

If you think someone else has access to your account, sign out, then open Help in the top bar and choose Contact support, or email support@theobelisk.app.

API keys let reporting tools and your own scripts read or update your Obelisk data. Keys belong to the organization, not to one person, and come with the Team and Agency plans.

To create a key:

1. Open Settings and choose API keys.
2. Choose Create key.
3. Give it a Name after the tool that will use it, such as "Reporting dashboard".
4. Choose the Access:
   • Read only: can read sites, audits and reports. Can't change anything.
   • Read and change: can also add sites and start audits. Can't manage people, billing or keys, or delete anything for good.
5. Choose Create key, copy the key, then choose I've copied it.

You only see the key once, so keep it in a password manager. Anyone with it can use your data.

To revoke keys, select them on the Active tab, choose Revoke, then confirm with Revoke. Tools using them stop working right away, and this can't be undone. Revoked keys move to the Revoked tab. The Last used column shows when each key was last used.

Only owners can create or revoke API keys. Admins can see the list.