Sessions & sign-in persistence
How Scrydon's sign-in method ladder works, how long you stay signed in, what "Remember me" and "Trust this device" do, and why you might be asked to sign in again.
Sign-in methods
After you enter your email address, Scrydon presents the available sign-in methods in preference order — starting with the most secure:
- Passkey — a device-bound credential (Touch ID, Face ID, Windows Hello, or a hardware security key). No password required; phishing-resistant by design. Recommended for all users.
- Email code — a one-time code sent to your email address. Valid for 15 minutes, and it must be entered in the same browser that requested it (see below).
- Email sign-in link — a one-click link sent to your email address. Opens a session when you follow it.
- Password — a traditional password. Available as a fallback; disclosed last so stronger options are seen first.
You can choose any method available to your account — the order reflects what we recommend, not what you are forced to use. The methods offered are tailored to your account: a passkey only appears if you have one registered, and the server refuses email sign-in methods for accounts protected by two-factor authentication (see below). Password is always available as a last resort.
Your organization can require stronger sign-in
Organization administrators can raise the bar for their own organization under Settings → Governance → Identity. Both controls are off unless someone turns them on, so nothing here changes for you unless your administrator says so.
| Requirement | What changes for you |
|---|---|
| Two factors | An emailed link or code is no longer enough on its own. Sign in with a passkey, or with your password followed by your authenticator app. |
| Phishing-resistant only | Only a passkey opens this organization. If you have not registered one, ask your administrator before you need access. |
| No email sign-in | Emailed links and codes are turned off, and so is "forgot password" — an administrator resets your password for you instead. |
One thing to expect when "no email sign-in" is switched on: a sign-in link or code that was already sent to you before the change stops working the moment you use it. A password-reset link sent beforehand is the one exception — it stays usable until it expires on its own, which is at most a few minutes.
The requirement belongs to the organization, not to you. If you are a member of several organizations, you are only held to the requirements of the one you are opening. Signing in the usual way still works for your other organizations; you will be asked to sign in again with a stronger method at the moment you switch into the stricter one.
Requirements apply when you open an organization, not retroactively. Turning one on does not sign anyone out — people are asked for a stronger method the next time they enter that organization.
Email codes are tied to the browser that requested them
A one-time code only works in the browser where you started signing in. If you request a code on your laptop and try to type it on your phone, it will be rejected — the code is not a password you can carry between devices.
This is deliberate. Because the code is bound to your browser, nobody else can use it, and nobody else's attempts can interfere with yours: someone who knows your email address cannot request codes to "use up" your attempts or invalidate the code sitting in your inbox.
If you want to sign in on a different device from the one holding your inbox, use the email sign-in link instead. The link works from any device.
A few related behaviours:
- Requesting a new code replaces the previous one. Always use the most recent email.
- You get five tries per code. After that, request a new one — this affects only your own sign-in attempt.
- If you request several codes in quick succession, we send one and reuse it, so you are not left guessing which of three emails to open.
Signing in with two-factor authentication
If your account has two-factor authentication (2FA) enabled, Scrydon requires one of these server-verified flows:
- A passkey completes sign-in only after your device verifies you, for example with Touch ID, Face ID, Windows Hello, or a security-key PIN. A user-verified passkey satisfies the requirement by itself.
- A password, social account, or organization SSO sign-in continues to the 6-digit code from your authenticator app (TOTP). The form submits when you select Verify — there is no time pressure while you type.
Email-channel methods (email code and email sign-in link) are not accepted as a substitute for the authenticator when 2FA is enabled.
If you lose access to your authenticator app, use a recovery code — a set of single-use backup codes issued when you first enrolled 2FA. Go to the sign-in page, complete your password step, then choose Use a recovery code on the authenticator screen. Each code can only be used once. Generate new recovery codes in Settings → Security while you still have access to your authenticator.
After 5 consecutive unsuccessful authenticator or recovery-code checks, Scrydon temporarily locks second-factor verification for 15 minutes. Further attempts return a retry-later response (HTTP 429) until the window expires. A successful verification clears the failure counter.
Scrydon uses secure, HTTP-only session cookies. How long a session lasts depends on the choices you make at sign-in.
Session duration
| Sign-in choice | Session lifetime | Survives closing the browser? |
|---|---|---|
| Remember me checked (default) | 30 days, extended while you keep using the platform | Yes |
| Remember me unchecked | 24 hours maximum, not extended | No — ends when the browser fully exits |
With Remember me (the default), your session is valid for 30 days and the expiry slides forward as you use the platform — you stay signed in on that browser until you sign out, are deactivated, or stop using Scrydon for 30 days.
If you untick Remember me, Scrydon issues a stricter session: it ends when your browser fully exits (including mobile browsers being evicted in the background) and expires after at most 24 hours either way. Choose this on shared or public machines.
Single sign-on (SSO), passkey, and magic-link sign-ins always use the 30-day remembered behavior.
Two-factor authentication and "Trust this device"
If your account has two-factor authentication enabled, password, social, and organization SSO sign-ins continue to a 6-digit code from your authenticator app. A passkey instead completes sign-in only when its authenticator reports that it verified you locally.
Ticking Trust this device before verifying a credential sign-in registers the browser as trusted for 30 days: you won't be asked for a second factor on that device during that window. The trust is bound to your account and device and is re-validated server-side. Federated social and organization SSO sign-ins always require the local authenticator challenge, even on a device previously trusted for credential sign-in.
Why was I signed out?
- You (or an administrator) signed you out or revoked your sessions — for example after deactivation or a password reset.
- You signed in with Remember me unchecked and the browser exited, or the 24-hour limit passed.
- Your session reached the 30-day maximum without activity.
If you are signed out unexpectedly on a corporate device, also check for browser policies that clear cookies on exit.