Reliability & security hardening
Everything in v1 still holds — this is what got added on top of it. Four things worth knowing if you're deciding whether to point production traffic at this. Read v3 for what's changed since →
API keys are never stored in plaintext
Your key is shown to you exactly once — in the welcome email, and again if you regenerate it. After that, only a one-way cryptographic hash is kept, the same approach used for passwords. There's no "forgot my key, show it to me again" — only regenerate.
Sign-in codes are single-use and short-lived
Each login code works exactly once. Submit it again — even seconds later, even before it expires — and it's rejected. Codes expire automatically, and repeated wrong guesses lock the code out well before brute-forcing six digits becomes practical.
Your API key never travels in a URL your server logs
The one-click dashboard link carries your key in a part of the URL that browsers never transmit to any server. Every other request the dashboard makes sends it as a request header instead — never as part of a URL.
Every project has a fair-use ceiling
OpticsOps runs on shared infrastructure, so every project has a daily processing allowance (10,000 spans/day on the free tier) that keeps one team's traffic from degrading service for everyone else. Ordinary usage — even a busy service with real error volume — stays well under it.
Sessions
Signing in issues a session cookie that JavaScript can't read (httpOnly), only sent over HTTPS, and valid for 7 days — it survives closing your browser, so you're not asked to sign in again every visit. Signing out clears it from your browser immediately. A well-formed session token is a bearer credential like any other, so treat access to your machine and inbox accordingly.
Where this still falls short
- No compliance certification. No SOC2, HIPAA, or similar — see the comparison page for what that rules out.
- Single ClickHouse VM. Still the case as of v1 — no replication, no automated failover.
- No SSO, RBAC, or audit logs. One API key per project, one login per account. Fine for a small team, not built for an enterprise org chart yet.
- Early beta. Each version here is a record of what was true at the time, not a permanent guarantee — see v3for what's current.