Account access and session lifecycle

Account entry is hosted on https://venture.infra.one. Authenticated sessions are shared across the Infra One service subdomains.

Entry routes

Purpose	Route	Public control
Register	/auth/register	Create an account
Sign in	/auth/sign-in	Sign in
Request passwordless PIN	/auth/sign-in/passwordless	Get PIN code
Enter passwordless PIN	/auth/sign-in/passwordless/enter-pin/:user_id	Your sign-in PIN code
Request password reset	/auth/reset-password	Email me a reset link
Confirm account	/auth/confirm/:token	Confirm my account
Complete second factor	/auth/totp	Verify code and sign in

The sign-in and registration pages always offer Passwordless alongside email/password. Google, LinkedIn, and Apple appear only when that provider is enabled and configured. A successful social-provider flow can sign in an existing account or create and confirm a new one; passwordless access never creates an account.

Authentication states

State	Protected-route behavior
Anonymous	Redirect to sign-in and preserve an eligible return destination
Signed in, unconfirmed	Redirect to confirmation instructions
Signed in, profile incomplete	Redirect on the current service host to /app/users/onboarding
Signed in, TOTP pending	Redirect to /auth/totp
Confirmed and onboarded	Continue; product membership and capability checks still apply
Suspended or deleted	End protected access

Lifetimes and limits

Credential or token	Lifetime or limit	Consumption behavior
Server-side web session	60 days	Removed on sign-out, password reset, or other session invalidation
Shared sign-in cookie	30 days	Issued only after full authentication; can restore a web session across Infra One services; cleared on sign-out
Concurrent web sessions	50 per account	Creating another prunes the oldest valid session
Passwordless PIN	10 minutes	Replaced on resend; purged after success, expiry, or too many attempts
Incorrect passwordless PINs	Three	After three incorrect submissions, a further validation ends the attempt
Email confirmation link	7 days	Bound to the current primary email and consumed on confirmation
Password-reset link	1 day	Single-use; a successful reset deletes all account tokens and sessions

Without a two-factor authentication challenge, Remember me belongs to the email/password form and is selected by default. Leaving it selected writes the 60-day web remember cookie; clearing it omits that cookie. In that no-challenge path, social-provider and passwordless sign-ins write the 60-day web remember cookie automatically. When Two-factor authentication appears, Keep me logged in for 60 days on that challenge determines whether the completed sign-in writes this cookie, regardless of the first-factor method.

Every fully authenticated sign-in separately writes the 30-day shared sign-in cookie. It can restore a web session on Infra One services when the ordinary browser session or 60-day remember cookie is absent, so clearing either remember checkbox does not guarantee that access ends when the browser closes. Sign out ends the current web session, invalidates the current shared sign-in token, and clears the shared sign-in cookies.

At this product revision, the sign-out response does not remove the domain-scoped 60-day remember cookie itself because its deletion omits the matching domain option. The current server-side session token is invalidated, so the retained value cannot continue that session. On a shared device, also clear the browser's Infra One site data when removing the stored cookie is required.

Authorization boundary

Authentication answers “which account is this?” It does not answer:

• which organizations the account belongs to;
• which role or service grants it holds;
• whether a gated service is enabled;
• whether an invitation, record, or token belongs to that account.

For settings-specific effects, see Settings access and lifecycle.