Security

How ModelSidecar protects workspace access.

Google sign-in. Admin access uses Google OAuth. ModelSidecar never sees or stores your Google password.
Workspace-scoped access. Every model, share link, and setting belongs to a workspace; members only see the workspaces they belong to.
Approved accounts only. Signing in requires an approved Google account. An unapproved sign-in attempt is rejected and no account is created.
Session security. Sessions are stored server-side as hashed tokens behind an httpOnly, secure cookie — never in browser storage, and never readable by page scripts.
Audit trail. Sign-ins, sign-outs, and access denials are recorded in a workspace-scoped security log visible to workspace admins.
No secret exposure. Tokens, cookies, and OAuth payloads are never shown in any admin screen, audit entry, or API response.