Security Guide

Nocarta uses modern authentication methods and session management to keep your account secure.

Authentication Methods

Magic Links (Email)

Passwordless login via secure email links
Links are single-use and expire after use
No passwords to remember or leak

Passkeys (WebAuthn)

Sign in with Face ID, Touch ID, or Windows Hello
Phishing-resistant authentication
Cryptographic keys never leave your device
Industry standard FIDO2/WebAuthn protocol

To add a passkey: Settings → Security → Add Passkey

Session Management

View and manage all your active login sessions across devices.

Viewing Active Sessions

Go to Settings → Security
Scroll to Active Sessions
See all devices where you're logged in

For each session you can see:

Device type: Web browser, mobile, or desktop app
Browser/OS: Chrome on macOS, Firefox on Windows, etc.
IP address: Network location of the device
Last activity: When the session was last used
Current session: Marked with "This device" badge

Terminating Sessions

If you notice suspicious activity or want to log out from another device:

Find the session in your Active Sessions list
Click Terminate next to the session
Confirm the action

To terminate all sessions except your current one:

Click Terminate All Other Sessions
Confirm the action
All other devices will be logged out immediately

Note: You cannot terminate your current session. Use the regular logout button instead.

Session Timeout Settings

Sessions automatically expire based on two factors:

Inactivity Timeout

Sessions expire after a period of inactivity
Default: 2 hours of inactivity
Configurable: 15 minutes to 8 hours
Activity is tracked on each request

Absolute Expiration

Sessions expire after 24 hours regardless of activity
Ensures periodic re-authentication
Cannot be disabled

Security Best Practices

Recommended Actions

Add a passkey for faster and more secure login
Review active sessions periodically
Terminate unused sessions from devices you no longer use
Use unique login per device rather than sharing sessions

If You Suspect Unauthorized Access

Go to Settings → Security
Click Terminate All Other Sessions
Review your account activity
Consider adding a passkey if you haven't already

Vault Security

For information about securing your secrets and credentials, see the Secrets Guide.

API Tokens

An API token lets a program — a script you wrote, a service you run, or an AI assistant you connected — use your Nocarta account without a browser login. There is exactly one kind of token, and you decide what each token is allowed to do.

Creating a Token

Go to Settings → Profile and Connections
In the API Access section, click New Token
Give it a descriptive name (e.g., "Reporting script")
Select only the permissions it needs — each permission covers one area, such as reading your form templates or creating entries
Optionally set an expiration date
Copy the token immediately — it is shown only once and starts with nc_token_

Using a Token

Send the token in one of two request headers — both work on every endpoint:

# Option 1: Authorization header
Authorization: Bearer nc_token_your_token_here

# Option 2: X-API-Key header
X-API-Key: nc_token_your_token_here

The full list of endpoints and permissions is in the API guide. To connect an AI assistant instead of writing code, see AI Integration.

Security Details

Never stored in full: Nocarta keeps only a one-way fingerprint of the token — the token itself is shown once, at creation, and cannot be recovered later
Scoped: a token can only do what its selected permissions allow, nothing else
Revocable: delete a token at any time from the same page — it stops working immediately
Expiration: tokens can carry an expiration date after which they are refused
Tracked: each use is recorded, so you can see when a token was last active

Good Habits

Create one token per program, so revoking one never breaks another
Grant the smallest set of permissions that works
If a token may have leaked, delete it — then create a fresh one