Authorization PIN¶
An authorization PIN is a personal credential for selected sensitive actions inside a workspace. Workforce owns the PIN associated with that workspace's staff record. It is separate from the password used to sign in to Zerohive and from the temporary code used to confirm a PIN change.
Local documentation draft. The backend contains a PIN update flow with unresolved validation and confirmation constraints. Figma shows the intended three-step journey. The current WorkOS frontend displays demonstration states and does not perform the update. Environment delivery and reader acceptance remain unverified.
What the PIN is for¶
Some work asks for an authorization PIN before proceeding. Inspected examples include updating an account signature and validating selected mailbox actions. Each action still has its own access, identity and business rules; knowing a PIN does not grant a role, approve a request or bypass workspace restrictions.
| Item | Purpose |
|---|---|
| Account password | Sign in to the person's Zerohive identity |
| PIN-update code | Confirm the requested PIN-change journey through the staff email |
| Authorization PIN | Authorize a supported sensitive action for the workspace staff record |
| Signature | A separately maintained asset used by supported signing processes |
Use password recovery for a forgotten account password. Use the PIN guide for the intended setup or replacement journey. PIN maintenance does not itself update a signature file, sign a document, send an email or complete an approval.
Who owns the change¶
The PIN endpoints act on the current signed-in staff member in the current tenant. They do not take another person's identifier as the target. A manager or administrator should help resolve access problems through authorized support processes, not collect a person's PIN or use this journey on their behalf.
Select the intended workspace before starting. A PIN update for one staff record is not evidence that the person's credential in another workspace changed. Updating the PIN does not reset the account password, reactivate the account or grant WorkOS access.
What successful completion means¶
A completed update replaces the stored PIN representation. It requests a change email and an inbox notice, and the steps request activity-history entries. Those effects are separate from confirmed delivery to a reader. A static success page or an email alone should not be treated as proof that every dependent action is ready.
For managers and executives, this capability supports deliberate authorization within existing responsibilities. It does not establish a certification, universal second factor, approval delegation or enforced organization-wide PIN policy. Current confirmation and frontend limitations must be resolved and the deployed journey verified before stronger assurances can be made.
Read next¶
The task guide explains the intended controls, prerequisites, errors and support steps. The private integration reference records source composition and the work needed to qualify confirmation, validation and recovery. For ordinary profile and workspace selection, see account profile.
For the image used by supported approval and signing processes, see signature enrollment and replacement. Configure the PIN first, then follow that image-and-PIN journey; saving a PIN alone does not enroll a signature.