Account Security: OAuth, Sessions, and Best Practices

How Serpverse Account Security Works

Serpverse account security starts with a deliberate design choice: the platform does not store passwords. Every account authenticates through Google OAuth, Microsoft OAuth, or Email Magic Links, which means your security depends on the strength of your Google or Microsoft account (or email inbox) rather than a separate set of credentials.

This guide explains how authentication works, what happens with your sessions, how provider linking works, and what to do if something goes wrong.

Authentication Through OAuth

When you sign in to Serpverse, you are redirected to either Google or Microsoft to verify your identity. Serpverse never sees or stores your password. Instead, the OAuth provider confirms that you are who you claim to be and sends back a token that grants access to your Serpverse account.

What Serpverse receives from your OAuth provider:

• Your email address
• Your full name (kept private — visible only to you and admins; the other party in an order only ever sees your display name)
• A unique provider ID (used to link your OAuth identity to your Serpverse account)

What signing in does not give Serpverse:

• Your password
• Your contacts, calendar, or other account data
• Access to your email inbox or files

Connecting Google Search Console (Publishers)

Publishers can connect Google Search Console for two things: to prove they own a listed website, and to show that website's measured Google traffic on its listing. Both are separate from signing in, entirely optional, and never requested when you log in — you only see them if you choose them on a listing's page. They ask Google for the same read-only permission. They differ in what Serpverse reads with it, and in whether it keeps access afterwards.

Connecting to Verify Ownership

What the connection can do: read the list of Search Console properties your Google account owns, so Serpverse can confirm your website is among them.

What it doesn't do: change anything in Search Console, read your search performance data, or reach any other part of your Google account. The permission is read-only, and verifying uses it for your property list alone.

Three things worth knowing before you use it:

• It can use a different Google account than the one you sign in with. Google will ask you to choose an account, which is expected — the account that owns a Search Console property often isn't the one you sign in to Serpverse with. Picking a different one doesn't create a second Serpverse account and doesn't change how you sign in.
• Access isn't kept. Serpverse reads your property list once, at the moment you connect, and doesn't hold on to access afterwards.
• You can revoke it safely. Serpverse will appear on Google's third-party access page(opens in new tab), possibly under whichever account you chose. Removing it is safe and doesn't un-verify any listing you've already verified. The one thing it does end is a traffic connection made with that same Google account, described below.

If you'd rather not connect a Google account at all, the file-upload and DNS methods prove the same thing — see verifying domain ownership.

Connecting to Show Your Traffic

This is a second connection, and you make it on purpose: from the Search Console traffic card on a listing's page. It puts the clicks Google counted for your site on your listing, beside the traffic estimate.

What the connection can do: read which properties your Google account owns, and one figure for each site you've listed on Serpverse — its total clicks from Google Search over the last 28 days.

What it doesn't do: read your search queries, your pages or a breakdown by country, change anything in Search Console, or reach any other part of your Google account. Google's answer includes the site's total impressions alongside its clicks, and Serpverse keeps only the clicks. The property list is used to match your listings and isn't kept.

Where it differs from verifying:

• Access is kept. The figure is read again about once a week, so Serpverse holds read access, stored encrypted, until you disconnect.
• The click total is stored and shown to buyers. It appears on your listing with the date it was read.
• Removing the access ends the figure. Disconnect from the listing's Manage tab and the figure comes off your listings at once. Remove Serpverse in your Google account instead, and it comes off at the next weekly read. Either way, your sign-in and your verified listings aren't affected.

Showing your Search Console traffic walks through connecting, what buyers see, and disconnecting.

Sign-In Methods and Your Account

Serpverse supports three sign-in methods: Google OAuth, Microsoft OAuth, and Email Magic Links. Your account is tied to the first method you used when you signed up, and the two social methods are never linked to each other by a shared email address.

The email magic link is the exception, and it's the one worth remembering.

How this works in practice:

• Whichever method you sign up with first becomes the way you sign in to that account
• If you signed up with Google and later try Microsoft on the same email, Serpverse will not merge them — you'll see a message that the email is already linked to a different sign-in method
• An email magic link always opens the account that owns that address, no matter which method created it. If you signed up with Google, a magic link to the same address still signs you into that same account
• The reverse is not true: if your account was created by a magic link, Google and Microsoft won't open it, because they were never connected to it

Practical implications:

• Pick one sign-in method and stick with it so you always land in the same account
• If you're ever unsure which one you used, request an email magic link — it's the only method guaranteed to reach your existing account
• This rule is about signing in only. Connecting Google Search Console, to verify a website or to show its traffic, is a different thing entirely, and it's fine — expected, even — to use a different Google account for it
• Switching between Google and Microsoft on the same email won't open your existing account — it shows the "already linked to a different sign-in method" message instead
• Signing up with a genuinely different email address creates a separate account

See the sign-in troubleshooting guide if you encounter issues during sign-in.

Session Management

After successful authentication, Serpverse creates a session that keeps you signed in. Here is how sessions work.

Session Duration

Once you sign in, you stay signed in as long as you keep using Serpverse: each visit extends your session, and it only ends after 30 days without one. Then you'll be asked to sign in once more through your provider. The session is tied to the browser you signed in with, so signing in on a new browser or device starts a fresh session there.

What Your Session Tracks

While you're signed in, Serpverse remembers a few basics so it can show you the right experience:

Signing Out

You can sign out from any dashboard page using the sign-out icon in the top-right corner. Signing out clears your session in that browser, so you'll need to sign in again through your provider to get back in. Because the session lives in your browser, signing out on one browser does not sign you out on another — sign out on each device you've used if you're on a shared or public computer.

Signing out of Serpverse does not sign you out of Google or Microsoft. These are independent sessions.

What to Do If You Cannot Sign In

Most sign-in issues fall into predictable categories. Work through these in order:

1. Wrong Sign-In Method

The most common issue. If you see a role selection screen, a "Complete your account" prompt, or a message that your email is already linked to a different sign-in method, you're signing in with a different method than the one your account was created with. Go back and sign in using your original method (or the magic link for that email).

2. Browser Cache or Cookie Issues

Stale session cookies can prevent successful authentication. Clear cookies specifically for serpverse.io in your browser settings, then try again.

3. Ad Blocker Interference

Privacy extensions and ad blockers can block the OAuth redirect flow. Temporarily disable them or add serpverse.io, accounts.google.com, and login.microsoftonline.com to your allowlist.

4. Corporate Network Restrictions

If you are on a corporate network, your IT department may block OAuth redirect URLs. Try signing in from a personal device or mobile data connection.

Securing Your Sign-In Accounts

Because your Serpverse account security is only as strong as your underlying OAuth account, protecting that Google or Microsoft account is critical. A compromised OAuth account means a compromised Serpverse account.

The same goes for the inbox at your account's email address. An email sign-in link opens your Serpverse account whichever method you signed up with, so anyone who controls that inbox can sign in — and if you sign in with email links rather than Google or Microsoft, that inbox is the account to protect.

Enable Two-Factor Authentication (2FA)

This is the single most effective security measure you can take.

Google:

1. Go to Google Account Security(opens in new tab)
2. Under "How you sign in to Google," enable 2-Step Verification
3. Choose your verification method: authenticator app (recommended), security key, or phone prompts

Microsoft:

1. Go to Microsoft Account Security(opens in new tab)
2. Under "Additional security options," enable two-step verification
3. Set up the Microsoft Authenticator app or an alternative method

Another email provider: if your account's email address is with a different provider, turn on two-step verification in that provider's security settings too.

Use a Strong, Unique Password on Your OAuth Account

Your Google or Microsoft password should be:

• At least 12 characters long
• Unique (not reused on any other service)
• Stored in a password manager rather than memorized or written down

Review Connected Applications

Periodically review which applications have access to your OAuth account:

• Google: Third-party apps with account access(opens in new tab)
• Microsoft: Apps and services(opens in new tab)

Revoke access for any applications you no longer use. While Serpverse needs to remain authorized for sign-in, removing unused applications reduces your attack surface.

If you've connected Search Console, you may also find Serpverse listed with Search Console access — possibly under a different Google account than the one you sign in with. Revoking that entry doesn't affect your sign-in or un-verify any listing. If the account is connected to show your Search Console traffic, revoking it also takes that figure off your listings at the next weekly read.

Monitor Sign-In Activity

Both Google and Microsoft provide sign-in activity logs. Check these periodically for unrecognized devices or locations:

• Google: Recent security activity(opens in new tab)
• Microsoft: Recent activity(opens in new tab)

If you see a sign-in you do not recognize, change your password immediately and review your Serpverse account for any unauthorized activity.

Account Roles and Permissions

During initial setup, you select a role — Buyer or Publisher — along with a display name. This role determines which features and dashboard sections you can access.

Your initial role is not permanent. You can switch between Buyer and Publisher at any time using the role switcher in your dashboard sidebar. Review the getting started guide for details on the initial role selection process.

Account Suspension and Access

Serpverse may suspend accounts for policy violations. A suspended account keeps full read access — you can still sign in, browse, and read your orders and messages — and can still message on and finish orders already under way, but starting anything new, like placing or accepting an order or withdrawing funds, is blocked. A suspension doesn't cancel your existing orders or move your funds. If your account is suspended:

• You will receive an in-app notification giving the reason, and an email too unless you've switched off Account Suspended in Settings → Notifications
• Your data and order history remain intact during suspension
• To request reinstatement, open a ticket from Support in your dashboard — it stays open to suspended accounts. The account status guide walks through the appeal
• See the publisher rules for enforcement details

Security Checklist

Use this checklist to audit your account security:

• 2FA enabled on your Google or Microsoft account, and on your email inbox
• Strong, unique password on your OAuth account
• Unused third-party app permissions revoked
• Sign-in activity reviewed for unrecognized access
• Correct OAuth provider remembered for Serpverse sign-in
• Ad blockers configured to allow Serpverse and OAuth domains