Security FAQs

Common questions about authentication, data protection, and security.

How does authentication work?

Scalar uses JWT (JSON Web Token) based authentication:

Access tokens are short-lived (typically 15 minutes)
Refresh tokens are long-lived (typically 7 days) and blacklisted on logout
Clients must refresh access tokens before they expire

Does Scalar support two-factor authentication?

Yes. You can enable two-factor authentication (2FA) for your account in your user settings for an extra layer of security.

How are OTPs handled?

One-time passwords (OTPs) are used for email verification during registration and password reset flows:

OTPs expire in 10 minutes
Rate limited to 5 requests per hour per email
The system doesn't reveal whether an email exists (security measure)

How is data isolated between companies?

All business data is scoped to a company. This means:

Every resource belongs to exactly one company
All database queries filter by company to prevent data leakage
Users cannot access resources from companies they don't belong to
Public endpoints only expose data from companies that allow public visibility

Are API keys secure?

Yes. API keys are:

Stored as hashes (never in plain text)
Rate-limited to prevent abuse
Shown only once when created
Rotatable if compromised

Keep your API key secret and never expose it in client-side code (browsers, mobile apps).

How should I store my API key?

Do: Store in environment variables or a secret manager
Do: Use server-to-server communication only
Don't: Commit keys to version control
Don't: Include in client-side code (JavaScript bundles, mobile apps)

What if my API key is compromised?

Rotate your key immediately:

Go to Settings > API
Click Regenerate key
Update all integrations with the new key
The old key is revoked immediately

How does password reset work?

User requests a password reset
OTP is sent to their email
User enters the OTP to verify their identity
User sets a new password

The system uses the same response regardless of whether the email exists, preventing account enumeration attacks.

What validation is applied to passwords?

Scalar uses Django's built-in password validators which check for:

Minimum length
Common passwords
Numeric-only passwords
Similarity to user attributes

How are refresh tokens secured?

Refresh tokens are blacklisted on logout. This means:

Logging out invalidates the refresh token
The token cannot be reused even if captured
Users must log in again to get a new token pair

Are endpoints rate-limited?

Yes. All public endpoints are rate-limited to prevent abuse. API endpoints have specific rate limits based on the endpoint type and your subscription tier.

The Widget Signing Secret is a separate key from your API key. It's used to verify user identities in the survey widget. Your server uses it to generate HMAC-SHA256 session proofs that are passed to ScalarWidget.identify().

Found in Settings > API alongside your API key
Must be kept server-side only (never expose in client-side code)
Used for identity verification, not API authentication

See identifying users for setup instructions.