Operator access tokens
Expiring operator credentials support remembered second-factor checks and password-based API access.
What it is
INSIDE uses expiring operator credentials for two purposes. One lets your browser remember a completed second-factor check. The other lets a compatible integration obtain temporary access using an operator's email address and password.
Who uses it and why
- Operators remember a trusted computer to reduce repeated second-factor prompts.
- Developers use temporary operator credentials where their integration supports operator-based authentication.
Where to find it
On the sign-in screen, the second-factor prompt can show Don't ask again for this computer. Temporary API credentials are issued through authentication, with no separate Settings screen for operators to manage them.
How it works
When you complete sign-in and select Don't ask again for this computer, INSIDE keeps a credential in your browser for that operator account. On a later sign-in, INSIDE checks that the remembered credential belongs to your account and has not expired before accepting it for the second-factor step.
For API access, a compatible integration submits the operator's email address and password. A successful response provides a token and its expiry time. INSIDE records this connection as Auth Token. Use the returned credential unchanged and obtain a new one when it expires. Ask Powerfront to confirm the supported request format and website identification for your integration.
The remembered-computer credential and the API credential serve different purposes. They are not interchangeable.
Configure it
Select the remember-computer option during sign-in when it is offered. There is no client Settings control for these token lifetimes. Ask Powerfront to confirm the lifetimes used by your account's environment.
The release's initial API-token lifetime is one minute. The initial remembered-factor lifetime is 30 days. Integrations should use the expiry returned with each issued API token.
Limits and good to know
- Remembering a computer depends on retaining its browser cookies. Clearing them can bring back the second-factor prompt.
- The password-based token flow does not perform the same second-factor exchange as interactive sign-in in this release.
- These credentials identify an operator. They do not provide the integration scope and IP restriction controls described under My Api Keys.
- Expiry is checked using UTC. There is no operator token list or individual revoke button in this flow.
Depends on and works with
View all connections as a list
This feature uses
- INSIDE APIRelated
Confirm which INSIDE API operations support operator access tokens before integrating.
- Login and email verificationRequires
Password-based token issuance authenticates an operator account.
- Two-factor authentication for operator sign-inEnhances
Remembered credentials can satisfy a subsequent second-factor check.
- Logout and remembered computersRelated
Logout and remembered-computer guidance explains how remembered verification differs from a console session.
Used by
- Operator accountsEnhances
Operator access tokens provide an additional access method and are revoked when the account is disabled.
- Roles and permissionsEnhances
Operator access tokens provide an alternative way to identify an operator where supported.
- Logout and remembered computersEnhances
The optional remembered-computer function uses an expiring operator access token.
- INSIDE APIEnhances
Integration requests can use an operator access token where supported.
FAQ and troubleshooting
Why am I asked for a second factor again?
The remembered credential may have expired, or the browser may no longer hold it. Complete the second-factor prompt again.
Why did my integration stop authenticating?
Check the expiry returned with the token. Obtain a new credential through the authentication flow when it has expired.
Can I use the remembered-computer credential for an integration?
Use the credential issued for the integration's authentication flow. The remembered-computer credential has a separate purpose and validation process.
Can I change the lifetime in My Account?
There is no lifetime control there. Ask Powerfront to confirm the configured lifetime.