Your client’s content in Git. Their secrets never.

Notes, activity and submissions are copied to branches of their own on the server, secrets left out. They never leave with your content.

• Accounts

  Two-step sign-in

  Anyone can turn on an authenticator app. Then a stolen password isn’t enough, even after GitHub or Google.

  • Ten spare codes for a lost phone
  • Sign-in tries are limited

  core/src/twoFactor.ts

  const TICKET_SECONDS = 5 * 60;
  const RECOVERY_CODES = 10;
  
  /** Ten codes like `K7QX-M2PD`, each good once, for when the phone is lost. */
  function newRecoveryCodes(): { shown: string[]; stored: string[] } {
      const shown = Array.from({ length: RECOVERY_CODES }, () => {
          const raw = base32Encode(randomBytes(5)).slice(0, 8);
          return `${raw.slice(0, 4)}-${raw.slice(4)}`;
      });
      return { shown, stored: shown.map(digest) };
  }

  What’s behind itBack to the card

• Roles

  Each person, their part

  The client’s editor writes. Their manager approves. Only your developers change what the site can read.

  • Eight roles, set per project
  • Nobody sees a project they aren’t in

  api/src/middlewares/auth.ts

  export function requireDeveloper(req: Request, res: Response, next: NextFunction) {
      requireProjectAccess(req, res, () => {
          if (!hasRole(req.user, 'developer')) {
              return void res.status(403).json({ error: 'Developer access required' });
          }
          next();
      });
  }

  What’s behind itBack to the card

• Operators

  The people who run the server

  They sign in on a page of their own, with their own authenticator. A user’s session never works there.

  • They can reset a lost phone
  • They can’t read anyone’s codes

• Keys

  A key that only reads

  The client’s site gets a key for one channel: the models and fields you chose, once they’re live. Lose it, and you make another.

  • Limited to the client’s domains if you like
  • Drafts only through a preview link that expires

  core/src/projectApiKey.ts

  const HASH_ALGORITHM = 'sha256';
  
  function hashKey(rawKey: string): string {
      return crypto.createHash(HASH_ALGORITHM).update(rawKey, 'utf8').digest('hex');
  }

  What’s behind itBack to the card

• Webhooks

  Signed, so you know it’s us

  Every call Moteur makes to your server carries a signature you can check. It never calls an address inside a private network.

  • Tried again if your server is down
  • Its secret is encrypted

  core/src/webhooks/webhookService.ts

  function computeSignature(secret: string, rawBody: string): string {
      const hmac = crypto.createHmac('sha256', secret);
      hmac.update(rawBody);
      return 'sha256=' + hmac.digest('hex');
  }
  
  // …
  'X-Moteur-Event': payload.event,
  'X-Moteur-Delivery': delivery.id,
  'X-Moteur-Signature': signature,
  'X-Moteur-Timestamp': timestamp

  What’s behind itBack to the card

• Forms

  Bots get a thank-you

  And they land in Spam. Your emails and entries only happen for people, and the server checks every answer.

  • Turnstile, hCaptcha or reCAPTCHA
  • Too many sends to one form are refused

  core/src/formGuard.ts

  export async function screenSubmission(
      projectId: string,
      form: FormSchema,
      proof: SubmissionProof,
      locale?: string,
      now = Date.now()
  ): Promise<Screening> {
      if (proof.honeypotTriggered && form.honeypot !== false) return { spamReason: 'honeypot' };
  
      const out: Screening = {};
      const age = formTokenAge(projectId, form.id, proof.token, now);
      if (age !== undefined) out.fillSeconds = age;
      const trap = form.timeTrap;
      if (age !== undefined && age < (trap?.minSeconds ?? DEFAULT_MIN_SECONDS))
          return { ...out, spamReason: 'too_fast' };
      // … then the captcha, asked of its provider

  What’s behind itBack to the card

Checked 2026-10-27. Self-hosting covers the engine and its API. The Studio runs on Moteur Cloud.

Document

On Moteur Cloud, or on your own server

Checked

2026-10-27

1

Self-hosting covers the engine and its API. The Studio runs on Moteur Cloud.