LogPulse supports multiple authentication methods to fit your organization's security requirements. Users can sign in with email and password, OAuth social login (Google and GitHub), or API keys for programmatic access.

Access control is managed through a role-based system with four levels: Owner, Admin, Member, and Viewer. Organizations provide multi-tenant isolation for companies managing multiple teams or products.

Standard email and password authentication is available for all LogPulse accounts. New users create an account with an email address and password, then verify their email address via a confirmation link.

LogPulse supports OAuth social login with Google and GitHub. Users can sign in with their existing Google or GitHub accounts without needing to create a separate LogPulse password.

When available, SAML SSO will support enterprise identity providers, automatic user provisioning and deprovisioning, attribute mapping, and group-based role assignment.

API keys provide programmatic access to the LogPulse API. Each key is scoped to specific permissions and can be rotated or revoked at any time without affecting other keys.

lp_live_a1b2c3d4e5f6g7h8i9j0   (production key)
lp_test_a1b2c3d4e5f6g7h8i9j0   (test/staging key)

The following table shows the complete permissions matrix for each role.

The audit log records all administrative and security-relevant actions performed within your organization. It provides a tamper-evident trail for compliance audits and security investigations.

The following events are recorded in the audit log:

Each audit log entry includes the timestamp, actor (user email or API key ID), action, resource affected, source IP address, and user agent. Audit logs are retained for 365 days regardless of your data retention plan.

{
  "timestamp": "2026-03-21T14:32:10.000Z",
  "actor": "[email protected]",
  "action": "alert_rule.created",
  "resource": "rule_high_error_rate",
  "resource_type": "alert_rule",
  "ip_address": "203.0.113.42",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
  "details": {
    "rule_name": "High Error Rate",
    "severity": "warning",
    "channels": ["ch_slack_ops"]
  }
}

LogPulse session management provides controls for session duration, concurrent sessions, and forced logout.

Sessions are managed by Better Auth and expire after 7 days. The session token is refreshed every 24 hours. Cookie validation is cached for 5 minutes to reduce database lookups. When a session expires, the user is redirected to the login page. Secure cookies are used automatically in production environments.

Follow these recommendations to secure your LogPulse organization:

Use OAuth social login where possible. Encourage team members to sign in using Google or GitHub OAuth, which delegates authentication security (including MFA) to the identity provider.

Rotate API keys regularly. Establish a key rotation schedule (recommended: every 90 days) and automate the rotation process where possible. Use separate keys for each service or environment to limit blast radius.

Apply the principle of least privilege. Assign users the minimum role required for their responsibilities. Use ingest-only API keys for logging agents and read-only keys for dashboards and monitoring tools.

Configure an IP allowlist. Restrict dashboard and API access to your organization's IP ranges. This prevents unauthorized access even if credentials are compromised.

Review the audit log regularly. Set up a monthly review of audit log entries for unusual patterns: failed login attempts, API key creation from unexpected IPs, or role changes.

Use OAuth for teams. Google and GitHub OAuth centralizes authentication and delegates credential management and MFA to the identity provider.