Frequently asked
questions

wispr is an account security platform built for Minecraft account holders. It automates the full Microsoft account security workflow — rotating recovery codes, refreshing XBL session tokens, and hardening authentication — with live log streaming and a searchable account catalog.

wispr supports four battle-tested methods: OTP (one-time password via recovery email), Zyger (alternative auth flow), MSAAUTH (Microsoft Authenticator app), and Recovery Code flows. Each handles the full Microsoft auth stack end-to-end.

Once you submit your credentials, wispr spawns a Node.js worker subprocess that authenticates with Microsoft OAuth, fetches your Minecraft profile, dispatches an OTP to your recovery inbox (or uses your chosen method), rotates your recovery code via PBKDF2, and refreshes your SSID and XBL session tokens — all within ~40 seconds on average. Every step is streamed live to your browser via server-sent events.

Credentials are used only for the duration of the secure run and are not persisted in plaintext. Recovery codes, session tokens, and account metadata are stored in an encrypted PostgreSQL database. You can delete any account from your catalog at any time. Share links are password-protected and expire after 7 days.

wispr uses Discord OAuth for authentication. Sign in with your Discord account — access is granted based on your server roles. If you don't have access yet, join the wispr Discord and request it in the appropriate channel.

Bulk recovery lets you run the secure flow across dozens of accounts in parallel using a ThreadPoolExecutor-backed concurrency engine. You can configure the max concurrent worker limit, set a stop-on-error policy, and monitor per-account progress in real time from the bulk jobs view.

From any account in your catalog, you can generate a password-protected share link. The recipient can view the account's credentials and metadata on a standalone page — no login required. View counts are deduplicated by IP (24-hour cooldown) to prevent inflation. Links expire after 7 days and can be revoked instantly.

wispr exposes a REST API under /api/v1/secureapi/* authenticated via wspr_sk_* API keys. The CLI (secure_recovery_cli.py) wraps every endpoint — run bulk jobs, manage accounts, stream logs — all from your terminal without a browser. API keys are scoped and isolated per-key.

SSID (Session ID) is the Minecraft session token used for Xbox Live authentication. It has a finite validity period. When it expires, certain features (like cape equipping or server auth) may fail. wispr can refresh your SSID on demand without running a full secure pass.

Join the wispr Discord server for support, feature requests, and announcements. For bugs or technical issues, open a thread in the #support channel with your job ID and a description of the problem.