Sign in
The hosted app is https://app.socialautomagic.com:47391. A self-hosted server uses the address your operator gave you. The sign-in page is the only page a visitor sees before a session exists.
Sign in with the email and password for your user. The first owner is created by the person who installed the server. Later people join from an invitation link.
Cloudflare Access
Section titled “Cloudflare Access”Some offices put the public site behind Cloudflare Access. When your browser arrives with a valid Access token, the password form is hidden and the page says you are signed in with Cloudflare Access, followed by your email. Log out ends the app session and sends you to the Access logout page.
The address with the port, such as https://app.socialautomagic.com:47391, does not go through Access. That page still asks for the email and password. A missing or invalid Access token does the same. An operator turns this on in the server settings. It is off until they do.
Session
Section titled “Session”The browser cookie is HttpOnly. On the hosted site it is marked Secure. A session lasts 14 days and is not extended when you click around. A session with no requests for 30 minutes is rejected even if the cookie is still there. Logging out revokes that session. Security can sign you out of every session.
The browser session is not an assistant key. Logging out does not revoke an AI client, and revoking a client does not end your browser session.
The header has a theme control: light, dark, or match the system. The choice is saved in this browser. It does not change the workspace for anyone else.
Password reset
Section titled “Password reset”Forgot password on the sign-in page accepts the address. If an account exists, a reset letter is recorded for the operator of the server.
Email delivery of that letter is coming soon. This build does not send the letter to an inbox. Ask the person who runs the workspace to open the operator outbox, or to set a new password for you. Do not put a password in chat, in a screenshot, or in a ticket.
Authenticator
Section titled “Authenticator”On Security you can turn on a time-based one-time code.
- Start setup. The page shows a secret you add to an authenticator app.
- Enter the current code to confirm.
- Store the recovery codes somewhere only you can open. They are shown once.
Turning it off asks for your password and a current code. The same page lists recent sign-in events and the sessions that are still active.
If sign-in bounces you back
Section titled “If sign-in bounces you back”A Secure cookie on a plain http:// site is dropped by the browser, so a successful sign-in returns you to the sign-in page. Local HTTP needs the server’s secure-cookie setting off. The hosted site and any public server should stay on HTTPS.