Accounts and security

This page shows how to keep your AgentDB account and data safe. You can:

• sign in with a password, an emailed link or a passkey;
• turn on two-step sign-in;
• create, review and revoke API keys;
• give each AI agent its own key and role;
• invite people and limit what they see;
• delete a workspace you own.

#Your account

An account belongs to one email address. It can own several workspaces. Each workspace is a separate project with its own data.

Create an account at https://app.agentdb.link/app/sign-up. AgentDB emails a confirmation link, valid for 24 hours. You can sign in with your password after you confirm the address.

#Sign in

People sign in to the app at https://app.agentdb.link/app/login. There are three ways:

The emailed link always works, also for accounts without a password.

Password rules: 12 to 256 characters. AgentDB refuses common passwords and your email address. A few unrelated words make a strong password.

Forgot your password? Open /app/forgot-password. AgentDB emails a reset link, valid for 30 minutes. A reset signs out every browser session. API keys and connected apps keep working.

Wrong passwords slow down further attempts, up to 15 minutes. There is no permanent lockout.

A browser session ends after 12 hours without use, and after 7 days at most.

#Two-step sign-in

Two-step sign-in asks for a second proof after your password or emailed link. Turn it on in Settings → Sign-in and security. Your email address must be confirmed first.

Second factors:

• Authenticator app: a 6-digit code from an app such as 1Password, Google Authenticator or Aegis.
• Passkey: your device's fingerprint, face or PIN. You can add up to 20, each with a name.
• Recovery codes: 10 single-use codes. AgentDB shows them once, when two-step sign-in turns on. Save them.

How to set up an authenticator app:

1. Open Settings → Sign-in and security.
2. Choose Set up an authenticator app. Enter your password when asked.
3. Scan the QR code with your app.
4. Enter the 6-digit code to switch it on.
5. Save the 10 recovery codes in a safe place.

A passkey sign-in counts as both steps, so it needs no password.

AgentDB emails you when a factor is added or removed, and when a recovery code is used. It also emails you when a new browser signs in.

Security changes need a sign-in from the last 12 hours. Examples: a new password, a new email address, or a new factor.

Two-step sign-in protects people. API keys, agent keys and AI connectors are not affected by it.

#API keys

An API key lets an agent, a script or the CLI use AgentDB. It starts with adbk. and goes in the Authorization header:

export AGENTDB_TOKEN="adbk.key_..."

There are two kinds:

• Account key: reaches every workspace of your account. Create it in Settings → Account API keys.
• Agent key: belongs to one named agent in one workspace. See the next section.

Key rules:

• AgentDB shows a key once. Store it in a password manager or a secret store.
• Never put a key in a web page. Use a dashboard link instead.
• Never paste a key into a chat. AI connectors such as Claude sign in through their own connection.

To rotate an account key:

1. Create a new key in Settings → Account API keys.
2. Put the new key in your tools and scripts.
3. Revoke the old key in the same list. It stops working at once.

The list shows each key's label, start, creation date and last use. Revoking also ends the file links that key created.

Key review. Keys can exist before you confirm your email address, for example when an agent signed up for you. After you confirm, AgentDB lists those keys, connected apps and data links. You choose Keep or Revoke for each one, before you can use the app.

#Named agents

Give each AI agent its own key and role. Then you can see what each agent did, and stop one without stopping the rest.

{"tool": "agents_create", "arguments": {"name": "support-bot", "role": "editor", "expires_in_hours": 720}}

• The key is shown once. Give it only to that agent.
• The role is viewer, editor or admin. It can never be higher than your own role.
• expires_in_hours makes the agent stop by itself.
• Every action of the agent is logged as agent:<id>.
• An admin agent can create sub-agents. They never get more rights than their parent.

{"tool": "agents_list", "arguments": {}}

agents_revoke stops an agent at once. Its keys stop working, and so do the agents it created.

#Roles and permissions

Every person and agent in a workspace has a role:

Permission rules narrow access further. A rule can hide an object or a field, or make it read-only. Rules apply to viewers, editors and agents. They never apply to owners or admins.

This rule makes the salary field invisible to editors:

{"tool": "schema_define_object", "arguments": {"name": "employee"}}

{"tool": "schema_define_field", "arguments": {"object": "employee", "name": "salary", "type": "integer"}}

{"tool": "permissions_set", "arguments": {"subject": "role:editor", "object": "employee", "field": "salary", "access": "none"}}

A hidden field disappears from reads, filters, totals, the change feed and exports.

With owner_field, an agent sees only its own records. For example, only the tasks assigned to it.

Check what you may do with access_inspect:

{"tool": "access_inspect", "arguments": {}}

#Members

Invite people to a workspace by email, with a role. Owners and admins invite from Settings in the app, or with the API.

{"email": "ada@example.com", "role": "editor"}

• The invitation link works once, for 7 days.
• The person needs no account first. Accepting the invitation signs them in.
• An admin manages only members with a lower role. The owner manages everyone.
• A role change or removal takes effect on the next request.

Owners and admins see changes to members, agents and permission rules in the access log.

#Delete a workspace

Only the owner can delete a workspace. This works only in the app, never with an API key or an AI agent.

1. Sign in to the app as the owner.
2. Export your data first, if you want a copy. See Files and imports.
3. Open Settings and choose to delete the workspace.
4. Type the workspace name exactly to confirm.

The workspace then waits 30 days before AgentDB removes it:

• During those 30 days, the workspace is read-only for you, and closed to everyone else.
• Dashboards, links, webhooks and scheduled jobs stop at once.
• AgentDB emails a reminder 3 days before the removal.
• To cancel, open Settings and choose Restore. Everything comes back as it was.

After 30 days, AgentDB removes the data and the files for good.