Authentication methods and token lifecycle

Transport: HTTP Authorization: Bearer {token} header. Accepted credentials: primary workspace API key (format: agk_xxx.yyy) or 30-day access token from POST /api/v1/agent_tokens. Access tokens expire after 2,592,000 seconds. Credentials carry explicit scopes (e.g., traces:write, gateway:check, agent_commands:read).

Agents can mint a socket token via POST /api/v1/socket_tokens for WebSocket authentication. Socket tokens expire after 600 seconds (10 minutes).

Transport: session cookie (_agent_ops_key) set after login. Session lifetime: 14 days. Tokens older than 7 days are automatically reissued. Remember me cookie: _agent_ops_web_user_remember_me (14-day max age). Operator socket identity is tied to the authenticated session.

Transport: HTTP Authorization: Bearer {scim_token}. Token scope: workspace SCIM bearer token configured in workspace settings. Endpoints: all routes under /scim/v2/*. Content type: application/scim+json. SCIM tokens do not expire; rotate via workspace settings.

A signed-out user requests a reset at /users/forgot-password. The response is identical whether or not the address has an account: the page always states that a link was sent if the address has one, and never echoes the address back, so nothing on it can be used as an account-existence oracle. Requests are throttled per IP and per address (10 and 5 respectively per 15 minutes), and a throttled submit renders that same panel.

The link is single use and expires 60 minutes after it is issued. Following it opens /users/reset-password/:token. Changing the account's email address or suspending the account invalidates outstanding links. An unknown, expired, or already-used token renders one dead-end panel with a link back to request a new one.

Setting a new password deletes every token the user holds -- remaining reset links and all browser sessions -- and live sessions are disconnected immediately. An unconfirmed account is confirmed by the reset, since receiving the emailed link proves control of the address. Issuing a new link never invalidates one already in the inbox.