# Operator accounts & sign-in

Real operator authentication, separate from embedded customer identity.

Version 0.1.0 · Early pilot · unreleased SDK · Reviewed 4 November 2026

## Email and password

The MongoDB hosting profile implements Better Auth 1.7.14 with real password hashing, database-backed sessions, sign-out and session checks. Sign up with a name, email and a password of 12–128 characters. A new operator receives an empty account workspace; fixture records are not automatically added. Account creation and authenticated workspace/app setup have been observed through the deployed Vercel and Atlas service. Email ownership remains separate from password sign-in. Account settings supports name changes, password changes and ending other sessions; the email controls follow the service’s verified delivery status.

## Browser and customer sessions are different

Operator requests use the authenticated browser session and current workspace/app permissions. The SDK uses its own customer-scoped bearer credential. A browser cookie, public config ID or matching email must never be accepted as a substitute for the SDK customer scope. Cookie-authenticated mutations are checked against allowed origins.

## Verification and password recovery

When account email is available, request verification in Account settings or a password-reset link from sign-in. Verification links last 30 minutes. Reset links last 15 minutes, work once and end existing sessions after a successful password change. An accepted request does not prove inbox arrival. If the service is not configured and verified, these controls report unavailable. Password sign-in alone does not verify an email address.

## Workspace invitations

Owners create private, seven-day invitations with a role and explicit app access. The recipient signs in with the matching verified email before accepting. Copying a private link sends no email; the separate Send email action requires verified owner and mail readiness. Pending invitations reserve seats, revoked links stop working, access changes apply live, and the last owner cannot leave. Workspace selection never grants access by itself.

## Missing configuration

Without the MongoDB connection, a sufficient auth secret and the correct origin, sign-in reports unavailable. A visible form is not evidence that an account was created. No local operator shortcut is deployed through the hosting profile.