App sign-in and sharing

For each app you can allow:

• specific email addresses,
• everyone with an email at a domain, such as your company,
• everyone in your workspace,
• or anyone with the link.

Manage this under People, or on the app's own page with the sign-in switch. Turning sign-in on or off is a change like any other: it is previewed and approved before it takes effect.

1. They open the app. A sign-in step in front of it sends them to Archon.
2. They sign in with their Archon account. Archon checks the list.
3. If they are allowed, they land in the app. Otherwise they see “You do not have access”.

A session in the app lasts up to 12 hours. Archon checks the list again every 15 minutes, so removing someone ends their access within 15 minutes.

Archon is a standard OpenID Connect provider for each workspace, so an app can also verify visitors itself. The sign-in step is added when the app is deployed, and its secret is delivered to the app as ARCHON_APP_LOGIN_SECRET. It is never shown in the interface or in logs.

Each workspace has its own issuer, so a sign-in for one workspace's app is never valid for another's. A visitor's identity is scoped to the one app they opened. Codes work once and last 60 seconds. ID tokens last 15 minutes. If the access check fails for any reason, the visitor is not let in.