API keys
For scripts and the local AI. Send as
Authorization: Bearer <key>.
A key carries your identity and your permissions, so treat it like a
password. Use one key per purpose — then losing one means revoking one.
Change password
At least 8 characters with a capital and a special character — or 16+ characters of anything. Changing it signs you out everywhere else, which is deliberate: a password change usually means you think someone else had access.
Invite someone
Creates a single-use link that expires. They set their own password — you never see it, and it never goes through Slack.