Identity, sessions, and connected assistants

Use this page to see how people sign in to Vidext, how long a session lasts, how to end one, and how AI assistants connect on someone's behalf.

Passwordless sign-inCopy Anchor Link

Vidext signs users in with a six-digit, one-time code sent by email. The code expires after ten minutes. If it does not arrive, the sign-in page can send a new one after 30 seconds, or you can change the address. No reusable account password is stored by Vidext, and sign-in and code endpoints are rate-limited.

People whose organization is linked to Vidext Visual can also arrive from Visual already signed in, through an encrypted handoff that Visual issues for that person.

Production-session policyCopy Anchor Link

• A production session expires after seven days.
• An active session becomes eligible for refresh after one day of use.
• After a successful sign-in, Vidext keeps the four most recently active sessions and revokes older excess sessions.
• Session records include technical context such as IP address and user agent for security review.

These values describe the production environment. Development and preview environments can use different session lifetimes for testing.

Session invalidationCopy Anchor Link

Revoking a session invalidates its Vidext session token. It does not remotely lock, wipe, or sign out the underlying device from other services.

Users can review active sessions in security settings, revoke a specific session, or revoke all other sessions. If you believe an account or device may be compromised, revoke the affected sessions there and contact infosec-external@vidext.io if additional review is needed.

The Sessions page is open to admins and members. It is not listed in the settings menu today; the link above opens it.

Security-event recordsCopy Anchor Link

Vidext records security-relevant events separately from ordinary workspace activity. Examples include:

• successful session creation and session revocation;
• failed sign-in attempts;
• account creation and account linking or unlinking;
• invitations, membership changes, role changes, and denied join requests;
• agent registrations for AI assistants and the confirmation of their one-time codes.

Records can include the acting user, organization, event metadata, IP address, and user agent where available. They support internal security investigation and service operation. They are not currently offered as a customer-visible compliance-log export, and customers cannot configure their retention.

Connected AI assistantsCopy Anchor Link

An AI assistant reaches Vidext over MCP and acts as the person who connected it, in one organization where that person is an admin or a member. Its tools only read. See Access control for what it can reach.

There are two ways to connect one:

• OAuth. The person signs in to Vidext from the assistant and approves the connection.
• Agent registration. An agent that cannot open a browser follows Vidext's published /auth.md instructions: it asks for the person's Vidext email address, Vidext emails that person a six-digit code, and the agent exchanges the code for an access token that lasts seven days. The code expires after ten minutes and allows five attempts, and registration is rate-limited.

Vidext has no screen that lists or disconnects assistants today. Because the person's role is checked on every call, removing them from the organization or changing them to learner cuts their assistants off; an agent-registration token also stops working when its seven days are up. Connecting an assistant never changes the person's own email sign-in.

See Authentication for agents for the flows and scopes.