Getting started
Account access, verification and security
How sign-in, email verification, sessions, roles and account protection work.
Last updated: 2026-11-09
Sign-in and verification
New accounts must verify their email before using the workspace. After verification, sign-in issues a short-lived access token and a session-bound refresh mechanism. The browser session is checked with the API session record, so a copied access token alone is not enough.
If your account requires two-factor authentication, complete the second step before entering the workspace. The landing site never receives your Spifex password.
Roles and permissions
Workspace owners and admins can manage organization settings, members, billing and connector activity. Members only see the features and pages granted by their role and plan.
Some permissions are enforced in the API rather than only hidden in the interface. Do not rely on a hidden button as a security boundary.
Protect your account
- Use a unique password and enable two-factor authentication when available.
- Review active sessions and revoke devices you no longer use.
- Review Settings → AI connections to revoke unused assistant access.
- Report unexpected workspace access or billing changes to the workspace owner.