Skip to main content

​
Questions this guide answers

  • How does passwordless magic-link login work?
  • How do I enable and verify 2FA?
  • How many API keys can I create?
  • What happens when I revoke a key?
  • Can I disconnect Patreon anytime?
Verba supports passwordless email auth. Flow:
  1. Request a magic link with your email.
  2. Open the email and click the link.
  3. Verba verifies the token and signs you in.
Important behavior:
  • Magic links expire after 20 minutes.
  • You can request a resend.
  • Invalid/expired links must be requested again.

​
Two-factor authentication (2FA)

​
Setup

  • Open settings security section.
  • Generate QR/secret.
  • Confirm with a valid authenticator code.
  • Save backup codes.

​
Login verification

During protected login flows, Verba may require:
  • 6-digit authenticator token
  • Or 8-character backup code
Backup codes are one-time use and removed after successful verification.

​
Disable 2FA

  • Requires valid 2FA verification to disable.

​
API keys

​
Key format and limits

  • Keys use prefix: vka_
  • Active key limit: up to 3 keys

​
Key lifecycle

  • Create from Settings -> Security -> API Keys.
  • Full key value is shown once on creation.
  • Revoke any key instantly from dashboard.
  • Revoked keys stop authenticating immediately.

​
Authentication headers

Use one of:
  • Authorization: Bearer vka_...
  • x-api-key: vka_...
API keys are only shown in full once when you create them. Verba stores the verification form of API keys, not a reusable plaintext copy.

​
How Verba stores sensitive data

Verba applies extra protection to sensitive secrets before they are written to storage. Examples include:
  • 2FA secrets
  • 2FA backup codes
  • Connected-service access/refresh tokens
  • Bot/service tokens that must be reused later by the platform
  • Owner-provided Slack client secrets and signing secrets
  • Twitch broadcaster and dedicated bot-account OAuth refresh tokens
This means raw database access alone should not expose those values in their original usable form.

​
Connected services

​
Slack

Slack is dedicated-only. Each Verb owner creates an app and provides its Client ID, Client Secret, and Signing Secret. Verba encrypts those credentials and the OAuth bot token. Never paste them into a chat or knowledge entry.

​
Twitch

Twitch owners authorize a broadcaster account and a different bot account by OAuth. Verba stores and refreshes the resulting tokens; it never needs either account’s password or a manually pasted bot token.

​
Email

Verb owners do not receive mailbox credentials. Postmark SMTP and webhook credentials belong to the Verba deployment. Contact consent and unsubscribe state are scoped to one Verb and sender address.

​
Patreon linking

  • Patreon can be linked from settings.
  • Tier/benefits sync with account profile.

​
Patreon disconnect guard

Disconnect may be blocked while an active Patreon subscription is still attached.

​
Abuse protection and temporary IP bans

Verba uses Cloudflare edge protection plus smaller endpoint-specific backend limits to prevent request bursts, scraping loops, and automated flooding. If an IP repeatedly trips those protections, Verba can place it into a temporary ban ladder:
  • Three Cloudflare block events within 24 hours can promote an address to a 24-hour temporary ban.
  • A later repeat-offender promotion can extend that ban to 30 days.
Active bans are stored by Verba and synchronized with Cloudflare. Blocked requests receive an HTTP 403 response while the ban is active. Sensitive endpoints such as magic-link requests keep their own smaller limits even when an address is not banned. If you hit a temporary ban unexpectedly during normal use, stop rapid retries, wait for the window to expire, and contact support with:
  • Exact timestamp
  • Your public IP if known
  • The page or action you were using
  • A screenshot or error message

​
Profile asset uploads

From settings:
  • Avatar/banner image uploads are validated and moderated.
  • Keep files under dashboard limits (commonly 10MB for profile uploads).

​
Deleting your account

Account deletion removes your account data and associated records. Behavior includes cleanup for:
  • Verbs and related references
  • Group/DM associations
  • Messages and conversation records tied to deleted entities
Group ownership handling:
  • If other members exist, ownership can transfer.
  • If no replacement exists, owned groups may be removed.
Account deletion is destructive. Export or copy anything you need before confirming deletion.

Public API v1

Full endpoint docs for authentication, requests, streaming, and errors.

Troubleshooting

Fix login, 2FA, and API key issues quickly.