> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bkmark.it/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing Your Bkmark Account

> Set up two-factor authentication, passkeys, review active sessions, and manage personal API keys to keep your Bkmark account safe.

Bkmark gives you several layers of protection beyond a password: time-based one-time passwords (TOTP) via an authenticator app, hardware-backed passkeys, per-device session management, and scoped API keys for automation. Visit **Settings → Security** to access all of these controls.

## Two-factor authentication (TOTP)

Enabling TOTP means that signing in requires both your password and a six-digit code from your authenticator app. Codes rotate every 30 seconds and can't be reused.

<Steps>
  <Step title="Open the TOTP setup screen">
    Go to **Settings → Security → Two-factor authentication** and click **Enable authenticator app**.
  </Step>

  <Step title="Scan the QR code">
    Open your authenticator app — such as [Authy](https://authy.com) or [Google Authenticator](https://googleauthenticator.net) — and scan the QR code shown on screen. If your app doesn't have a camera option, tap **Enter key manually** and type in the text secret displayed below the QR code.
  </Step>

  <Step title="Enter the verification code">
    Your app will display a six-digit code. Type it into the **Verification code** field and click **Verify**. This confirms that your app is correctly synced before TOTP is activated.
  </Step>

  <Step title="Save your backup codes">
    After a successful verification, Bkmark generates **8 one-time backup codes**. Copy them somewhere safe — a password manager works well. Each code can only be used once and lets you regain access if you lose your phone. You can regenerate a fresh set of codes at any time from the same security settings page.
  </Step>
</Steps>

To disable TOTP, go back to **Settings → Security → Two-factor authentication**, click **Disable**, and enter a current six-digit code to confirm.

## Passkeys

Passkeys use your device's biometrics (Face ID, Touch ID, Windows Hello) or a hardware security key to sign you in without a password. They are phishing-resistant and bound to Bkmark's domain.

To add a passkey, navigate to **Settings → Security → Passkeys** and click **Add a passkey**. Your browser or operating system will prompt you to authenticate — use your fingerprint, face scan, or hardware key. The passkey is registered and available for your next login.

You can register multiple passkeys (for example, one on your laptop and one on your phone). Each passkey is listed with the device name and the date it was added. Click **Remove** next to any passkey you no longer want.

## Active sessions

Every time you sign in to Bkmark from a browser or device, a session is created. The **Active sessions** panel under **Settings → Security** shows all of your current sessions, including the browser user-agent, IP address, and the last time each one was active. Your current session is labelled **This device**.

To sign out of a specific device, click **Revoke** next to that session. To sign out of all other devices at once — for example, after losing a laptop — click **Revoke all other sessions**. Only your current session is preserved.

## API keys

API keys let you access your Bkmark data from scripts, automations, or third-party tools without sharing your password.

### Creating an API key

1. Go to **Settings → Security → API keys** and click **New API key**.
2. Give the key a descriptive **Name** (for example, `Home automation` or `Raycast extension`).
3. Select the **Scopes** the key should have access to (see the table below).
4. Optionally set an **Expiration date**. Keys without an expiration never expire automatically.
5. Click **Create**. The full key is shown **exactly once** — copy it now and store it somewhere secure. After you close the dialog, only the key's prefix is visible.

API keys have the prefix `bk_` followed by a random string (for example, `bk_3f9a1c2d…`). Bkmark never stores the raw key, so it cannot be recovered if lost. If you lose a key, revoke it and create a new one.

### Available scopes

| Scope             | Access granted                         |
| ----------------- | -------------------------------------- |
| `bookmarks:read`  | Read your bookmarks and their metadata |
| `bookmarks:write` | Create, update, and delete bookmarks   |
| `tags:read`       | Read your tags                         |
| `tags:write`      | Create, update, and delete tags        |
| `groups:read`     | Read your groups                       |
| `groups:write`    | Create, update, and delete groups      |
| `search:read`     | Run full-text searches                 |

Grant only the scopes that the integration actually needs.

### Using an API key

Pass the key as a Bearer token in the `Authorization` header:

```bash theme={null}
curl https://api.bkmark.it/api/v1/bookmarks \
  -H "Authorization: Bearer bk_your_key_here"
```

### Updating or revoking an API key

You can rename a key or change its scopes at any time by clicking **Edit** next to it in the list. To permanently revoke a key, click **Revoke** — the key stops working immediately.

<Accordion title="What happens if my API key expires?">
  Once a key passes its expiration date it is automatically rejected on every request. Any automation relying on it will receive a `401 Unauthorized` response. You'll need to create a new key and update your integration with the new value.
</Accordion>

<Accordion title="Can I use an API key to log in to the web app?">
  No. API keys only work with the REST API. Signing in to the Bkmark web app always requires your password, a connected social account, or a passkey.
</Accordion>

<Accordion title="How many API keys can I have?">
  The number of API keys available depends on your plan. Check your current plan limits under **Settings → Billing**.
</Accordion>

<Accordion title="Is my API key stored securely?">
  Yes. Bkmark never stores your raw API key — only an irreversible fingerprint used to verify it. Only you see the raw key, and only at the moment it's created. Even Bkmark staff cannot retrieve a key once the creation dialog is closed.
</Accordion>