Sign-in, sessions and extra verification¶
Draft based on the implementation snapshot recorded for this feature. Source reconciliation, design assessment, environment delivery and audience review are still in progress.
Zerohive uses one personal account to establish who you are, then checks which workspaces and administrative areas you may enter. Signing in does not grant membership of an organization or permission to use every product. Those checks happen when you open the relevant workspace or area.
This feature covers signing in with an email address and password, completing an email verification challenge, managing the account's extra verification setting, continuing a session and signing out. Account registration, invitations, password recovery and account reactivation are related journeys with their own rules; creating or recovering an account does not by itself restore every workspace permission.
Use the task guide for steps and recovery. If you have forgotten your password, follow the separate password recovery guide for the email code, new password and return to sign-in.
Who uses it¶
Employees, managers, external participants and administrators sign in through the account entry experience. Their later access differs according to membership, organization policy and assigned authority. A manager's job title does not bypass these checks. Platform staff enter a separate administrative context; being an administrator of one organization is not the same as being platform staff.
For business owners, the practical consequence is that account access, organization access and product access are separate controls. A successful sign-in tells you that the account has passed its required checks. It does not establish that a subscription is usable, an organization is active, a product has been deployed, or a person has authority to approve work.
What happens during sign-in¶
- Zerohive checks the email address, password and account state. An inactive or unverified account cannot complete normal sign-in.
- If account extra verification is disabled, successful credentials complete the account sign-in step.
- If extra verification is enabled, Zerohive sends a six-digit code to the account email address. The account is not signed in until that challenge is completed successfully.
- After successful sign-in, the continuation screen takes the person to their available workspaces. Workspace opening applies its own membership and policy checks.
The email code belongs to the pending sign-in attempt. Starting a new credential-based attempt replaces the earlier challenge. A delayed email from the earlier attempt can therefore contain a code that no longer works. A code can also become unusable before its nominal email-code expiry because the pending sign-in itself has expired. Restarting sign-in creates a fresh attempt.
Successful sign-in records the login and requests a login-alert email. Completing a challenge and actually receiving an email are separate events: message processing and the configured email provider determine delivery. The application does not promise an email arrival time.
Three different access checks¶
| Check | What it establishes | What it does not establish |
|---|---|---|
| Account sign-in | The account is active, verified and has satisfied the required credentials and account challenge | Membership of a particular workspace or permission to use its products |
| Workspace opening | Current membership, access permission and organization policy allow the selected context; extra verification may be requested | Unrestricted product use or payment clearance in a suspended organization |
| Platform console entry | The account has platform access and the required extra verification setting | Every administrative action; staff roles still control authority |
An organization can require extra verification when it is opened even if the account does not normally request a code at sign-in. Turning off account extra verification does not remove that organization policy. Platform-console entry requires the account's extra verification setting to be enabled.
Session behavior¶
A session lets Zerohive continue an authenticated interaction without asking for the password on every page. The frontend stores its session in an encrypted browser cookie that application JavaScript cannot read. Credential tokens are handled by the frontend server; browser-visible account information is a limited session summary.
Session continuity is bounded by the current credentials and account state. An expired session returns the person to sign-in. Recovering a deactivated account does not make credentials from before the account's invalidation point valid again. A newly authenticated session is required.
Returning to workspace selection clears the selected organization and administrative context while retaining the account sign-in where valid. Exiting an administrative context returns to the appropriate ordinary workspace or selection experience. Signing out clears the frontend session on the current browser. The current browser flow must not be described as a verified “sign out everywhere” feature.
Extra verification settings¶
The live My profile page displays the current extra verification setting. Enabling or disabling it requires a new email code for that change. Moving the switch starts the request; the setting changes after successful code confirmation. The server uses different challenge purposes for sign-in, enrollment, disabling and organization access, so a code from one operation should not be reused for another.
Administrators should account for these distinctions when helping people regain access. A mailbox-delivery problem, an expired sign-in, a disabled account and a blocked workspace require different recovery paths. Support should establish which step failed before suggesting an action.
Current limits and implementation gaps¶
- Resend code on the login verification screen does not currently provide a fresh login code. Restart sign-in with the email and password to obtain a new challenge.
- Send a new code on the profile confirmation form is also unreliable in this version. Return to My profile and restart the setting change instead.
- The separate extra-verification settings page does not yet display reliable live account information. Use My profile to check and change your current setting.
- Signing out ends the frontend session in the current browser. It does not confirm that sessions on other devices have ended.
- Actual availability depends on the environment. A planned or implemented application is not necessarily available in your environment; confirm access through your organization or support team.
These limits are part of the documented implementation. Their repair, design assessment and delivery must be recorded separately before the documentation describes the improved behavior as available.