OpenWAF has no passwords. You sign in with a one-time code sent by email, or with your Google or GitHub account. Signing up creates your user and your organization, the account that owns your domains, members and API tokens.
Sign up
- Open dash.openwaf.dev/signup (external link).
- Choose Continue with Google, Continue with GitHub, or enter your work email and select Email me a code. - Google and GitHub sign-in only work with an account whose email the provider has verified. - Disposable email addresses are not accepted.
- If you chose email, enter the 6-digit code from the message and select Continue. The code is valid for 15 minutes and allows 5 attempts. The email also contains a link: it opens a page that shows the address you are signing in as, and you confirm with Sign in as ….
- On Tell us about you and your agency, enter your name and the name of your agency or company.
- Accept the Terms of service (external link), the Acceptable use policy (external link) and the Data processing agreement (external link), then select Create organization.
You become the owner of the new organization. The dashboard then opens the wizard Let's protect your first site.
What your organization gets
- A fixed pair of nameservers under
ns.openwaf.dev, for examplefaros.ns.openwaf.devandpolaris.ns.openwaf.dev. The pair is chosen when the organization is created and never changes: every domain you delegate to OpenWAF uses the same two names. See Delegate a zone. - Room for up to 100 domains by default during early access. See Limits and plans.
- Members, clients, API tokens and an audit log of every change.
Sessions
A dashboard session lasts up to 30 days and ends after 7 days without activity. Sign out ends the current session; Account › Sign out everywhere ends all your sessions on every device. API tokens are not affected: revoke them in API tokens if needed.
Sign-in codes are rate limited: at most 5 codes per hour for one email address and 20 per hour from one IP address.
Delete your account
Account › Delete account ends your sessions and removes your memberships and API tokens. It also deletes any organization where you are the only owner and that has no domains left. While you are the only owner of an organization that still has domains, deletion is refused: delete those domains or make someone else owner first.
Sign in on a white-label dashboard
If your agency gives you a dashboard on its own domain (for example dash.youragency.com), sign in there with your email code. Google and GitHub sign-in are only offered on dash.openwaf.dev. See White-label dashboard.