CLItrail Docs

Account security

You reach your CLItrail account through your Google account or your mailbox: CLItrail keeps no password of yours. Protect them with 2-step verification or a passkey, and manage CLItrail’s own sessions in Account and security.

#Sign-in

Every sign-in goes through Firebase Authentication, with Google or a one-time email link, and must be recent when it reaches CLItrail. The server checks the token itself and asks Firebase whether the account is disabled or its sessions revoked. See Sign in.

#Sessions

  • A sign-in lasts 7 days, in an HttpOnly, SameSite=Strict cookie. Only a hash of the session token is stored.
  • Account and security lists each session with when it started and was last active, updated at most every 5 minutes. Sign out one session, or every other one.
  • Signing out of Google does not end CLItrail sessions already started; sign them out here.

#If someone else got in

Sign out every other session in Account and security, secure your Google account or mailbox, and revoke any destination credentials you are unsure of on the platform that issued them, then Replace them in CLItrail. Then email founders@pilotprotocol.network.

#Confirming who you are

Deleting your account, or an organisation that still has websites, asks you to sign in again first, even inside a session: with Google, or with a new email link. A sign-in by another account is refused (recent_sign_in_required).

#Delete your account

Account and security → Delete account removes your sessions, your support requests and your account. Organisations only you belong to are deleted with it, with their websites and data. You leave organisations shared with others; if you are the last owner of one, make someone else an owner first (transfer_ownership_first), and cancel any subscription of an organisation that will be deleted (subscription_active). What you did in shared organisations stays in their activity, without your name.

#Limits and activity

Dashboard writes are limited to 30 a minute per client address and reads to 600 a minute per session. Security activity lists the last 20 sign-ins and security changes on your account.