Sessions and single sign-on across products
You sign in once at Beyond Accounts and every product recognizes you. This page explains the two kinds of session, what travels between products, and what ends when.
- Availability: Experimental
- Evidence: Recorded run
- Explanation
The problem this solves
You sign in once and then open Delegate, Workspace or CDN without typing a password again. Later you sign out in one place and want to know what else ended. Both follow from one model.
Two kinds of session
| Accounts session | Product session | |
|---|---|---|
| Where you get it | By signing in at Beyond Accounts | When a product you open recognizes your Accounts session |
| What it can do | Everything about your account: profile, sign-in methods, organizations, invitations, sign out everywhere | Only tell that product who you are, and end itself |
| How long it lives | Until it expires, you sign out, or it is revoked | Never longer than the Accounts session it came from |
A product session is derived authority. It has none of its own.
What travels between products
When a product needs to know who you are, it sends your browser to Accounts. If you already hold an Accounts session, Accounts sends you straight back with a one-time code, which the product's own server exchanges for its product session. If you do not, you sign in first and are then returned to the same product.
- Your password never reaches a product.
- No credential crosses from one product to another in your browser. Each product keeps its own session cookie on its own address, and pages cannot read it.
- The one-time code is useless by itself: it works once, for one product and one return address, for about a minute, and only together with a secret that stays on the product's server.
- Accounts returns you only to an address the product registered in advance, compared exactly. See a refused return destination.
What ends when
| You do this | What ends |
|---|---|
| Sign out inside one product | That product's session only. Your Accounts session and the other products stay |
| Sign out in the Accounts header | The Accounts session of that browser and the product sessions opened from it |
| Sign out everywhere in Accounts | Every session of your account, at Accounts and in every product, on every device |
| Your Accounts session expires | The product sessions that came from it |
| Your account is suspended | Everything, and you cannot sign in again until it is lifted |
| You are removed from an organization | Nothing about your sessions. Products that use that membership withdraw what it carried |
How to do each of these is in Sessions and signing out.
How a product finds out
A product does not ask Accounts about you on every click. Accounts publishes a running list of ended sessions and changed memberships; each product's server reads it regularly, with a credential of its own, and applies what it says. In Delegate, that means ending the Delegate sessions concerned.
Because of this, an ended session stops working in a product within a short, bounded delay, not at the very same instant.
When Accounts cannot be reached
An unreachable Accounts is neither a yes nor a no. Within a short tolerance, a product keeps honoring the last list it read, so a momentary failure does not sign everyone out. Past the tolerance, it refuses sessions that came from Accounts, and it says so with a message of its own, which is not a sign-in error: in Delegate, "Beyond Accounts is not answering. Nothing was changed; try again shortly." When Accounts answers again, the product recovers. What to do is in Delegate recovery.
A product never treats an outage as an approval.
Limits
Next action
Review where you are signed in, or read how Delegate behaves when your session ends.
Related: Identity and resource permissions · Sign in and create an account