Connect the extension

Signing in happens here, on the website. The extension never sees your session — it gets a one-time code instead, which it swaps for its own token. That way a stolen code can only ever connect one extension, and you can disconnect it.

1. Sign in on this page.
2. We show you a six-digit code. It is valid for five minutes and can be used once.
3. Open the extension popup and type the code in.

Keep the code to yourself

• Anyone who types the code into their own extension within those five minutes connects to your account. Do not paste it anywhere.
• You can disconnect any connected extension at any time from your account, which revokes its token immediately.
• The extension is never given a long-lived refresh token.