Create your account and sign in

Start free at app.webdecoy.com →

The free plan does not require a credit card and does not expire. The same secure sign-in screen handles new accounts and returning users.

Create an account

1. Open app.webdecoy.com.
2. Continue with Google, Microsoft, GitHub, or Email.
3. Complete the Auth0 prompt. If the identity is new, WebDecoy creates the account; if it already exists, you return to your dashboard.
4. On first sign-in, name your organization and first site.

Authentication is managed by Auth0. WebDecoy receives the basic profile needed to identify your account and does not receive a social-provider password.

What WebDecoy creates on first run

Resource	Why it exists
Organization	The workspace for team access, billing, and all sites
Default property	The first site-scoped container for sensors, decoys, detections, and integrations
Example decoy	A live, WebDecoy-hosted decoy you can trip immediately to prove the detection pipeline
Free plan	Ongoing bot visibility with no card or trial clock

The dashboard then shows one next action at a time: install a sensor, see a real detection, and decide what should happen to the next one.

Continue with the 5-minute quickstart.

Sign in to an existing account

1. Open app.webdecoy.com/login.
2. Choose the same provider or email identity you originally used.
3. After Auth0 completes, WebDecoy returns you to the page you requested or to the dashboard.

If you followed a deep link before signing in, the app stores only the safe internal destination and restores it after the cross-origin Auth0 redirect.

Troubleshooting sign-in

Problem	What to try
The wrong workspace opens	Use the organization switcher in the app header
A social identity creates a separate account	Sign out and use the provider tied to the original account
Email sign-in fails	Use the reset-password option in the Auth0 email flow
The browser loops between login and callback	Allow first-party storage for app.webdecoy.com, then retry in a fresh tab
You cannot reach an invited organization	Open the original invite link while signed in with the invited email address
Sign-in still fails	Use Support at the bottom of the sign-in screen

Account security

• Authentication traffic is encrypted and handled through Auth0.
• API keys are separate from login credentials and can be scoped or revoked from Settings → API Keys.
• Team access is managed per organization. See Team access.
• Never paste an API key into a browser detection script; its generated data-aid and data-sid values are the correct browser credentials.