Account security

Updated 2026-10-30

To secure your Wolkra account, turn on two-factor authentication, review active sessions, give each team member the lowest role that works, use narrow API tokens and check the activity log now and then. Your servers are only as safe as the account that controls them.

Two-factor authentication (2FA)

Wolkra supports TOTP, the six-digit codes from an authenticator app.

1. Open your account settings in the console.
2. Choose Two-factor authentication and Enable.
3. Scan the QR code with your authenticator app.
4. Enter the current code to confirm.
5. Save any recovery codes you are given in a safe place, such as your password manager.

From then on, every sign-in asks for a code. Make sure at least two people in an organization have owner or admin access with 2FA, so losing one phone does not lock everyone out.

Sign in with Google

You can sign in with your Google account instead of a password. If you do, protect the Google account itself with 2-step verification, because it now guards your servers too.

Passwords

If you use email and password:

• use a long, unique password from a password manager;
• never reuse it on another site;
• change it at once if you suspect it leaked, then review sessions.

Active sessions

The console lists the devices and browsers where you are signed in. Review it and sign out any session you don't recognise, or ones from devices you no longer use. After a password change, sign out all other sessions.

Organizations, projects and roles

Resources belong to projects inside an organization. Organization roles:

On top of that, per-project roles decide what a member can do in each project. A common pattern:

• a production project where only a few people can change things;
• a staging or dev project where developers have full access;
• a billing person with the billing role and no server access.

Invite members by email from the organization settings. Remove people promptly when they leave, and rotate any shared secrets they knew.

Activity log

The activity log records what happened in the organization: who created, changed or deleted resources, and when. Use it to:

• see who changed a firewall or deleted a server;
• check for changes nobody remembers making;
• review changes after an incident.

API tokens

Tokens are a common weak point because they end up in scripts and CI systems. Keep them narrow:

• one token per use, named after where it runs;
• read access unless writing is needed;
• an IP allow list for tokens used from fixed addresses;
• an expiry date for temporary work;
• delete tokens you don't recognise.

See API tokens.

Protect resources from mistakes

• Turn on delete protection for important servers.
• Enable backups and take snapshots before big changes.
• Use labels such as env=prod so it is obvious what a server is for.

Security on the servers

Account security and server security go together. On each server:

• log in with SSH keys only (SSH keys guide);
• keep the system patched and run a firewall (secure an Ubuntu server);
• use a cloud firewall to limit SSH to known addresses.

If you think your account is compromised

1. Change your password, or secure your Google account.
2. Sign out all sessions.
3. Turn on 2FA if it was off.
4. Delete and recreate API tokens.
5. Check the activity log and your resources for anything unexpected.
6. Open a ticket in the console or write to [email protected].

To report abuse coming from a Wolkra server, write to [email protected]. Privacy questions go to [email protected]. More on the product page: teams and security.