Authentication & Access Control

Sazabi provides multiple authentication methods and role-based access control to secure your organization's data.

Authentication methods

Email and password

The default authentication method uses email and password:

• Passwords are hashed using bcrypt
• Password strength requirements enforced
• Account lockout after failed attempts

Single Sign-On (SSO)

We support SSO through Google:

Magic links

For passwordless authentication, Sazabi supports magic link login. Users receive a secure link via email that logs them in without entering a password.

Organization structure

Organizations

Organizations are the top-level container for access control:

• All team members belong to an organization
• Billing and integrations are managed at the organization level
• Secret API keys are scoped to the organization

Projects

Projects provide data isolation within an organization:

• Each project has its own logs, threads, and alerts
• Public API keys are scoped to individual projects
• Team members can access all projects in their organization

For details on organizations and projects, see Organizations & Projects.

Roles and permissions

Sazabi uses role-based access control (RBAC) to manage what team members can do.

Available roles

Permission matrix

Assigning roles

To change a team member's role:

1. Go to Settings > Team
2. Find the team member
3. Click the role dropdown
4. Select the new role

Only Admins can change roles.

API key security

API keys provide programmatic access to Sazabi. For security best practices, see API Authentication.

Key types

Key management

• Store keys in environment variables, never in code
• Rotate keys regularly (at least annually)
• Use separate keys per environment
• Revoke keys immediately if compromised

Session management

Session duration

• Web sessions expire after 7 days of inactivity
• Sessions are invalidated on password change

Related topics