Your watch

24-hour monitoring

Add a package and this instance keeps measuring its blast radius. Any movement raises an alert here and on /api/v1/alerts.

Alerts

Raised by the watch, newest first. These arrive over a live stream — nothing on this page polls.

API keys

Stored only as a SHA-256 digest and shown once at creation. Every call a key makes is written to your security log.

Full reference, quickstarts and a live playground are on the API page.

Notifications

Alerts always land on this dashboard. Add a webhook and they also reach your systems — a signed POST the moment the watch sees something move, so nothing on your side has to poll.

const crypto = require('crypto');

// req.body must be the RAW bytes, not the parsed object
function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=')));
  const expected = crypto
    .createHmac('sha256', secret)
    .update(parts.t + '.' + rawBody)
    .digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(parts.v1));
}

Security log

Every sign-in, key creation, key revocation and API call made with your keys, with the address and agent that made it. Visible only to you.