> ## Documentation Index
> Fetch the complete documentation index at: https://docs.taberna.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Taberna is a crypto payments API. Amounts are priced in fiat (USD or EUR) and paid in crypto.
> Fiat amounts are ALWAYS decimal strings ("9.99"), never numbers. Crypto amounts are integer strings in the asset's smallest unit.
> Authenticate merchant endpoints with `Authorization: Bearer tbrn_live_...`. Every key is bound to one store and carries an explicit scope set, so never pass a store id to a /v1 endpoint.
> A 401 means the credential is bad; a 403 means the key lacks a scope. Never retry or re-authenticate on a 403 — surface it as a configuration error.
> The /v1/checkouts endpoints are deliberately unauthenticated and run in the buyer's browser. Never send an API key to a browser.
> Verify webhook signatures over the RAW request body before parsing JSON, and treat delivery as at-least-once: handlers must be idempotent.
> Never grant value based on a browser redirect to successUrl. Fulfil on a signature-verified webhook, or on a server-side read of GET /v1/orders/{id} or GET /v1/invoices/{id}.
> There is no test mode: every payment method is a live chain moving real funds.
> A merchant can run an entire shop with no code: the dashboard creates products and invoices, and every store can host a storefront at {slug}.taberna.io with its own theme, sections, branding and optional custom domain. Never assume the reader has an API integration.
> Taberna issues no refunds and performs no KYC. A refund is something the merchant sends from their own payout wallet, off-platform.

# Account security

> Two-factor authentication and the devices signed in to your account.

Your Taberna account controls where your money is sent, so it is worth locking down.
Everything here is under **Account → Security**, from the menu at the bottom of the
sidebar.

## Turn on two-factor authentication

Two-factor authentication means signing in needs your password *and* a six-digit code
from your phone, so a stolen password is not enough on its own.

1. Press **Enable 2FA**. Taberna shows a QR code.
2. Scan it with an authenticator app — Google Authenticator, Authy, 1Password, whichever
   you use. If you cannot scan, the setup code is printed underneath to type in by hand.
3. Enter the six-digit code the app shows, and press **Verify**.
4. Taberna shows your **backup codes**. Save them somewhere safe now.

<Frame caption="Scanning the setup code during two-factor setup.">
  <img src="https://mintcdn.com/taberna/CSV07Wzd5bzv2KKK/images/dashboard-2fa-setup.png?fit=max&auto=format&n=CSV07Wzd5bzv2KKK&q=85&s=06c581a122af00ae8ce3b9c1934b0a0b" alt="The Enable Two-Factor Authentication dialog showing a QR code and the manual setup code below it" width="1200" height="675" data-path="images/dashboard-2fa-setup.png" />
</Frame>

<Info>
  The backup codes are shown **once** and cannot be retrieved afterwards. They are how
  you get in if you lose your phone. Copy them into a password manager before pressing
  Done.
</Info>

From then on, signing in asks for a code after your password. Turning 2FA off asks for
your password to confirm.

## Check what is signed in

The **Active Sessions** card lists every device signed in to your account, with its
browser, operating system and when it was last used. Your current device is marked
**Active**.

Press **Revoke** on anything you do not recognise; it signs that device out immediately
and without asking twice. You cannot revoke the session you are using — sign out
normally for that.

## What is not here yet

There is no way to change your password, change your email address, or reset a forgotten
password from the dashboard. Email
[support@taberna.io](mailto:support@taberna.io) if you need any of them.