Skip to the page

Account and access

Who can get in, what they can do once they’re in, and how to take it back. All of it lives in Settings in the workspace.

Signing in

Sign in with a one-time code sent to your email, or with Google, GitHub, Microsoft, or Apple where they’re available. No password to forget.

Passkeys

Add a passkey in Settings and sign in with Face ID, Touch ID, Windows Hello, or a security key instead of waiting for a code. Add one for each device you use, and remove any you’ve stopped using.

Single sign-on

Let your team sign in through Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, or any SAML 2.0 provider:

  1. Add your company’s email domain and prove it’s yours with a DNS TXT record.
  2. Create a SAML app in your provider with the sign-in URL and entity ID from Settings, then paste its metadata link back.
  3. Choose whether everyone at the domain must use single sign-on.

Turn on SCIM provisioning and the people you assign to SpecStream in your provider join your projects with the role you choose, and lose access the moment they’re unassigned. Their spending limits still apply.

Sessions

Settings lists every browser and device signed in to your account, with when each one was last used. Sign any of them out from there. The one you’re using is marked, so you don’t lock yourself out by accident.

Audit log

Settings keeps a record of who did what: sign-ins, new keys and delegated access, approved spending and top-ups, exports and snapshots, monitors, and imports. Filter it by kind or by person, and export it as a CSV. Entries are kept for 12 months. Project owners see what happened in their projects; everyone sees their own activity.

API keys

An API key works with the REST API, MCP, the Python and TypeScript clients, and the command line. Give each key only what it needs:

  • A scope. Read, prepare, or execute. Only execute can start paid work.
  • Projects. Limit the key to the projects it works in.
  • An expiry date. Keys for a one-off job can end with the job.
  • A spending ceiling. The most the key can spend in total. All other spending limits still apply.

The key is shown once, when you create it. Revoke it any time; the next request made with it fails.

Agents and apps

Agents connect over MCP with OAuth. You review what each app asks for before it gets anything, and you can revoke it from Settings. Delegated access lets an agent start specific work without asking each time, inside a per-run limit, a monthly limit, and an expiry date. Anything outside those limits still comes back to you.

Webhooks

A webhook sends a signed message to your endpoint when a find completes (find.completed), when a monitor finds something new (monitor.found), or when records are added to a collection (collection.records_added). The signing secret is shown once, when you create it. Settings keeps every delivery attempt with its status, so you can see exactly what your endpoint missed. Revoke a webhook to stop deliveries.

Email and notifications

We email when something needs you, not for every run. Ordinary finds and successful monitor runs stay in the workspace, the desktop app and your phone.

Always sent: sign-in codes and links, a sign-in from a device we haven’t seen before, invitations, payment confirmations and billing changes, and the acknowledgement when you delete your account. They can’t be turned off, because they’re how you keep control of the account. Stripe sends the receipts.

Choose the rest in Settings, under Notifications:

  • Direct mentions. Someone mentions you in a note you can see.
  • Scheduled work needs attention. A monitor couldn’t run or finish, one email per problem, and a monitor’s first results, once.
  • Balance running low. Once when it gets low and once when it runs out, then nothing until your next top-up.
  • Getting started. Two short notes in your first two weeks. They stop once you’ve run a find.
  • Occasional product news. Off unless you turn it on, and at most once a month.

Every optional email has a one-click unsubscribe link that works without signing in.

Balance and payments

Billing shows your balance and where every dollar came from and went: monthly grants, top-ups, and the charge for each piece of work, with its quote. Invoices and payment methods are in the billing portal. How billing works

Export your data

Export your account and workspace data as a JSON file from Settings, whenever you like. For results in a spreadsheet instead, export a collection to CSV, Excel, JSON, or HTML, or to KML or GeoJSON when it has coordinates.

Delete your account

Deleting your account:

  • Removes access for you, and for every key and agent acting for you.
  • Revokes your credentials and any standing authority, including schedules.
  • Cancels your plan’s renewal.
  • Removes your saved work as part of the deletion request.

It asks you to confirm first, and you can’t undo it from the workspace. Export anything you want to keep.

Not a customer, but in someone’s results?

Anyone can ask SpecStream to stop using their website, email address, phone number, a profile of them, or their name with their employer, or send a request about themselves by name to see, correct, or delete what SpecStream holds. Use the opt-out page. Matching details are left out of future work and hidden from results people already saved.