docs(agentid-sign-in): separate the credential lifetimes and point at the saved-sessions page - #247
Merged
Merged
Conversation
… the saved-sessions page The guide stated one lifetime (30 days from activation) and nothing about the other objects a sign-in creates, so integrators read 30 days and 180 days as the same thing, or read a remembered approval as proof a key still works. It also never said where a saved session can be inspected or forgotten, or that revoking a key leaves a provider's own session intact. Both came up in integration reports on 2026-09-10 and 2026-09-15. Adds a lifetimes table (bearer key, pending and active sign-in key, remembered approval, tokens, provider session: who creates it, who holds it, how long, what ends it, what survives), a short section on sessions saved in the client that points at https://auth.agentid.com/sessions and says it lists only that client's sessions, and the troubleshooting case "I revoked a key but an agent is still signed in". Numbers mirror agentmail-api: BROWSER_ENROLLMENT_LIFETIME_SECONDS and BROWSER_CREDENTIAL_LIFETIME_SECONDS (browser-enrollment-control.ts), BROWSER_RP_CONSENT_LIFETIME_SECONDS (browser-consent.ts), ID_TOKEN_TTL_SECONDS (config/oidc.ts). No endpoint or behavior is introduced. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…rowser at auth.agentid.com/sessions Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
shalim786
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The sign-in guide states one lifetime (an active sign-in key expires 30 days after activation) and nothing about the other objects a sign-in creates. Integrators have read the 30-day key and the 180-day remembered approval as one object, taken a live approval as proof a key still works, and expected revoking a key to end a provider's session. The guide also never says where a saved session can be inspected or forgotten. Both gaps were raised in integration reports dated 2026-09-10 and 2026-09-15; the second explicitly asked for the sessions page to be discoverable from public docs, not only from a site footer.
What changes
One page,
fern/pages/guides/agentid-sign-in.mdx, three additions after "Manage sign-in keys":https://auth.agentid.com/sessions, says it lists only the sessions saved in the client that opens it, that forgetting one affects that client alone, and that revocation is theDELETE /v0/api-keys/{api_key_id}call already documented above.What does not change
No endpoint, parameter, or behavior is introduced. The page keeps the existing API-first voice (no new "browser" vocabulary beyond the page name AgentID itself uses).
Sources for the numbers
All mirror
agentmail-api: pending key at most five minutes (BROWSER_ENROLLMENT_LIFETIME_SECONDS, clamped to the transaction), active key 30 days (BROWSER_CREDENTIAL_LIFETIME_SECONDS), remembered approval 180 days (BROWSER_RP_CONSENT_LIFETIME_SECONDS), tokens ten minutes (ID_TOKEN_TTL_SECONDS/ACCESS_TOKEN_TTL_SECONDS), no revocation signal (plans/AGENTID_BROWSER_AUTHORIZATION.md, and the same caveat on agentid.com/docs#lifetimes).Checks
Prose-only MDX change; no raw
<in prose, all links absolute perAGENTS.md, target pages verified to exist (/api-reference/api-keys/create,/agentid-public-key-authentication). CI runsfern checkand the docs preview.Companion PRs
Same section on the AgentID reference: agentmail-web PR (follows). From the same handoff: agentmail-to/agentid-cli#35, agentmail-to/agentmail-api#1311.
🤖 Generated with Claude Code