Passwords, email and sessions
Verification, password changes, resets and how sessions are held.
- An email address is verified before the account can do anything that matters.
- A password reset is a one-time link to the verified address.
- Changing a password requires the current one, and the change is confirmed by email.
- Sessions use refresh rotation; a stolen refresh token stops working as soon as the real one is used.
- Live scan streams inside the app are bound to one scan by a token of their own, never to your session.
Questions
I did not get the verification email.
Check spam, then request it again from the banner in the app. If it still does not arrive, tell us the address and we will look at the delivery log.
Do you support SSO or SAML?
Not today. If it is a requirement for you, say so when you talk to us - demand decides the order things get built in.
Can I see my active sessions?
Not as a list yet. Changing your password ends other sessions, which is the blunt version of the same thing.
Something here wrong, missing or out of date? Tell us and we will fix the page.