# Operator access tokens

Expiring operator credentials support remembered second-factor checks and password-based API access.

*Release 3.3 · developer, operator*

## What it is

INSIDE uses expiring operator credentials for two purposes. One lets your browser remember a completed second-factor check. The other lets a compatible integration obtain temporary access using an operator's email address and password.

## Who uses it and why

- Operators remember a trusted computer to reduce repeated second-factor prompts.
- Developers use temporary operator credentials where their integration supports operator-based authentication.

## Where to find it

On the sign-in screen, the second-factor prompt can show **Don't ask again for this computer**. Temporary API credentials are issued through authentication, with no separate Settings screen for operators to manage them.

## How it works

When you complete sign-in and select **Don't ask again for this computer**, INSIDE keeps a credential in your browser for that operator account. On a later sign-in, INSIDE checks that the remembered credential belongs to your account and has not expired before accepting it for the second-factor step.

For API access, a compatible integration submits the operator's email address and password. A successful response provides a token and its expiry time. INSIDE records this connection as **Auth Token**. Use the returned credential unchanged and obtain a new one when it expires. Ask Powerfront to confirm the supported request format and website identification for your integration.

The remembered-computer credential and the API credential serve different purposes. They are not interchangeable.

## Configure it

Select the remember-computer option during sign-in when it is offered. There is no client Settings control for these token lifetimes. Ask Powerfront to confirm the lifetimes used by your account's environment.

The release's initial API-token lifetime is one minute. The initial remembered-factor lifetime is 30 days. Integrations should use the expiry returned with each issued API token.

## Limits and good to know

- Remembering a computer depends on retaining its browser cookies. Clearing them can bring back the second-factor prompt.
- The password-based token flow does not perform the same second-factor exchange as interactive sign-in in this release.
- These credentials identify an operator. They do not provide the integration scope and IP restriction controls described under **My Api Keys**.
- Expiry is checked using UTC. There is no operator token list or individual revoke button in this flow.

## Depends on and works with

### This feature uses

- **Requires** [Login and email verification](SEC-001.md): Password-based token issuance authenticates an operator account.
- **Works better with** [Two-factor authentication for operator sign-in](SEC-003.md): Remembered credentials can satisfy a subsequent second-factor check.
- **Related** [INSIDE API](EXT-018.md): Confirm which INSIDE API operations support operator access tokens before integrating.
- **Related** [Logout and remembered computers](SEC-004.md): Logout and remembered-computer guidance explains how remembered verification differs from a console session.

### Used by

- **Enhances** [Operator accounts](ADM-007.md): Operator access tokens provide an additional access method and are revoked when the account is disabled.
- **Enhances** [Roles and permissions](ADM-008.md): Operator access tokens provide an alternative way to identify an operator where supported.
- **Enhances** [Logout and remembered computers](SEC-004.md): The optional remembered-computer function uses an expiring operator access token.
- **Enhances** [INSIDE API](EXT-018.md): Integration requests can use an operator access token where supported.

## FAQ and troubleshooting

### Why am I asked for a second factor again?

The remembered credential may have expired, or the browser may no longer hold it. Complete the second-factor prompt again.

### Why did my integration stop authenticating?

Check the expiry returned with the token. Obtain a new credential through the authentication flow when it has expired.

### Can I use the remembered-computer credential for an integration?

Use the credential issued for the integration's authentication flow. The remembered-computer credential has a separate purpose and validation process.

### Can I change the lifetime in My Account?

There is no lifetime control there. Ask Powerfront to confirm the configured lifetime.