Sessions and authentication

Signing in

Vidext authenticates with email one-time codes — no passwords to leak or reuse. Sign-in and code endpoints are rate-limited against abuse.

Session policy

• Sessions last seven days, refreshed with use.
• Sensitive actions require freshness: operations like billing changes require a session authenticated within the last hour — if yours is older, Vidext asks you to re-authenticate first.

You can see and end your sessions

Every member can review their active sessions in security settings — and revoke any single session or all other sessions at once. Lost a laptop? One click ends its access.

Security audit log

Security-relevant events are recorded with technical context (IP address, user agent), separately from the workspace activity history, for security review:

• Sessions — sign-ins, individual revocations, and revoke-all.
• Failed sign-in attempts, so a pattern of them is visible after the fact.
• People — invitations, members added and removed, role changes, denied join requests.
• Structure — team creation, updates and deletion, and organization settings changes.
• AI assistant connections — the registration, the one-time code, and the moment a connection is confirmed.

For connected AI assistants

Assistant connections use OAuth with short-lived, scoped tokens — one user, one organization — and are revocable from either side at any time. Details in Authentication for agents.