# Security

How Arrakis protects your account, your money and your machines, and what stays your responsibility.

## Signing in

- Sign in with GitHub, Google or email and password. One account can hold all three (**Sign-in methods**).
- GitHub and Google sign-ins use PKCE and a one-time state, and only emails the provider has verified are accepted.
- An email already on an account opens that account directly only when the provider runs the mailbox (Gmail, Google Workspace). Otherwise the owner signs in once to connect the new method.
- A password reset signs the account out everywhere.

## Tokens

- Tokens are shown once and stored only as hashes. Revoke one and it stops working at once.
- Scopes (`read`, `rent`, `manage`, `billing`) limit what a token can do, and a token can't create a stronger one.
- Give agents their own token with a spend cap, a longest rental and an expiry.

## Money

- Payments run on Stripe; card numbers never reach Arrakis. The balance grows only when Stripe confirms a payment, and each payment is credited once.
- Rentals are prepaid by the hour, and the breaker stops machines the balance can't pay for. You never owe more than you added.
- **Stop everything** stops all machines at once.

## Isolation

Every request acts for the account its token belongs to. Accounts can't see or change each other's machines, payments or tokens.

## The machines

Machines run on independent hosts. Keep regulated data off them, and keep your own copy of anything important. Arrakis offers no uptime guarantee during early access.

## Rotating a token

1. Create a replacement with only the scopes and limits the job needs.
2. Put it where the job reads it.
3. Revoke the old one.

More: [all docs](/docs.md) · [OpenAPI](/openapi.json) · [llms.txt](/llms.txt)