Enter a keyword to search published documentation.
mywebdrive
Sign-in and Sessions
How email-code authentication works, rate limits, session lifetimes, roles, and what happens when you sign out.
Email-code authentication
/signin accepts an email address and a six-digit code—not a password. Requesting a code returns challengeId, expiresInSeconds: 600, and resendAfterSeconds: 60. Verification must use the matching email, challenge, and code. After changing the address or requesting another code, continue with the page's current challenge.
The server counts requests by UTC hour: at most 5 per email and 20 per IP, with a 60-second email cooldown. People sharing an internet connection may hit the same IP limit. Wait after 429; don't loop requests or switch networks to evade the limit. A challenge allows at most 5 failed code attempts and can be consumed successfully only once.
| Response | What it means and what to do next |
|---|---|
| Request returns 202 | Delivery was accepted; check actual receipt separately |
| Verification returns 400 | Invalid email, challenge, or six-digit format |
| Verification returns 401 | Invalid, expired, or already consumed challenge; request a new one through the page |
| 429 | Sending limit or exhausted verification attempts; wait as appropriate |
| 503 | Identity, database, Redis, or mail dependency unavailable; retry later and contact the operator |
Account creation and roles
The first successful verification creates an account; existing users keep their account. Compatibility routes like /signup, /register, and /reset-password don't imply password registration, password recovery, or invitation-code support.
Regular users land on /account; administrators land on /admin/overview. The server checks administrative permission. Editing a browser role or revealing a hidden button doesn't grant access. A management endpoint's 403 means the identity isn't an administrator.
Session expiry
An access token lasts 900 seconds. The browser refreshes using an HttpOnly refresh cookie. Refresh sessions have a 30-day idle lifetime and a 90-day absolute lifetime. Refresh rotates the token, and reuse of an old refresh token triggers session protection. Client coordination doesn't guarantee permanent sign-in.
Production refresh cookies use Secure, SameSite=Lax, and path /api/v1/auth. Use the correct HTTPS, same-origin entry point rather than mixing different hostnames for pages and APIs. Never put access tokens, cookies, or verification codes in URLs, screenshots, or public reports.
Sign out and limitations
Sign-out revokes the current refresh session, clears its cookie, and returns to sign-in. It doesn't delete files or promise to sign out every device. Already issued access tokens have their own lifetime. These guides don't describe account self-deletion or an all-device session-management interface.
When verification fails after mail arrives, check the current email and newest challenge. Keep the error status and time, not the code. Don't send codes to Ask Docs. See Troubleshooting.