1. Go to /signin and press Continue.
  2. You land on the sign-in page hosted by WorkOS (AuthKit). Sign in with a code sent to your work email, or with Google or Microsoft.
  3. WorkOS sends you back to Claros. First time: create a workspace, or accept the invite waiting for your address.
Claros never sees a password: WorkOS checks who you are and sends the codes. Only verified email addresses get in. Everything after that (workspaces, roles, keys, devices) is Claros’s own. If sign-in is cancelled or a code expires, you’re back on /signin with a short message; press Continue again.

​
The session

  • An httpOnly, Secure, SameSite=Lax cookie holding your WorkOS session, sealed (encrypted) with a key only the Claros server has.
  • Every request checks the WorkOS access token’s signature and a session row on the Claros server. Short-lived access tokens are refreshed by the server; a session lasts at most 30 days, and the inactivity and length limits set in WorkOS end it sooner.
  • Every write from the web app also needs the session’s CSRF token, and requests from other origins are refused.
  • Sign out deletes the session on the Claros server at once and ends the WorkOS session too.
  • The web app gets 1-hour capture tokens for the current workspace from the session. They die with the session or the membership.
Sign-in goes through the web app’s own address (/v1/account/* is passed through to the Claros server), so the cookie is first-party.

​
Limits

Account and device endpoints: 60 requests in a burst, then 5 per second per IP. Code delivery and retries on the sign-in page are WorkOS’s.
Not available yet: enterprise SSO placing people in a workspace automatically, changing your email, deleting your account, signing out everywhere.