Authentication and access

Anonymous pushes use a local device identity. They create public, read-only sites with a 72-hour expiry. scrapheap login uses an agent registration/browser-code ceremony plus a six-digit email OTP and atomically claims all active sites from that device.

CLI access tokens last one hour. The CLI refreshes them from a revocable 30-day registration credential. scrapheap logout revokes the registration, refresh material, and outstanding access tokens.

Private sites allow the owner and invited, email-verified users. Invitations are normalized to lowercase email records. Access is granted before delivery; a failed email returns a retryable warning, and repeating the invitation resends the direct site link. Removal revokes access immediately.

Dashboard-created site tokens are shown once and stored hashed:

• site:read reads metadata and deployment history.
• site:deploy adds push, file materialization, finalization, and rollback.

Tokens are bound to one site and cannot change access, invitations, tokens, or deletion. The default expiry is 90 days; owners can explicitly choose no expiry.