Sign-in and Sessions

Email-code authentication

/signin accepts an email address and a six-digit code, not a password. Requesting a code returns challengeId, expiresInSeconds: 600 and resendAfterSeconds: 60. Verification must use the matching email, challenge and code. After changing the address or requesting another code, continue with the page's current challenge.

The server counts requests by UTC hour: at most 5 per email and 20 per IP, with a 60-second email cooldown. People sharing an internet connection may reach the same IP limit. Wait after 429; do not loop requests or switch networks to evade the limit. A challenge allows at most 5 failed code attempts and can be consumed successfully only once.

| Response | Meaning and next step | | --- | --- | | Request returns 202 | Delivery was accepted; verify actual receipt separately | | Verification returns 400 | Invalid email, challenge or six-digit format | | Verification returns 401 | Invalid, expired or already consumed challenge; request a new one through the page | | 429 | Sending limit or exhausted verification attempts; wait as appropriate | | 503 | Identity, database, Redis or mail dependency unavailable; retry later and contact the operator |

Account creation and roles

The first successful verification creates an account; existing users retain their account. Compatibility routes such as /signup, /register and /reset-password do not imply password registration, password recovery or invitation-code support.

Regular users land on /account; administrators land on /admin/overview. The server checks administrative permission. Editing a browser role or revealing a hidden button does not grant access. A management endpoint's 403 means the identity is not an administrator.

Session expiry

An access token lasts 900 seconds. The browser refreshes using an HttpOnly refresh cookie. Refresh sessions have a 30-day idle lifetime and a 90-day absolute lifetime. Refresh rotates the token, and reuse of an old refresh token triggers session protection. Client coordination does not guarantee permanent sign-in.

Production refresh cookies use Secure, SameSite=Lax and path /api/v1/auth. Use the correct HTTPS, same-origin entry point rather than mixing different hostnames for pages and APIs. Never put access tokens, cookies or verification codes in URLs, screenshots or public reports.

Sign out and limitations

Sign-out revokes the current refresh session, clears its cookie and returns to sign-in. It does not delete files or promise to sign out every device. Already issued access tokens have their own lifetime. These guides do not describe account self-deletion or an all-device session-management interface.

When verification fails after mail arrives, check the current email and newest challenge. Retain the error status and time, not the code. Do not send codes to Ask Docs. See Troubleshooting.