From 7322c1e432722e7312b9e3776a498f6dc0bafb67 Mon Sep 17 00:00:00 2001 From: Sidharth Reddy <70673367+sidharth0612@users.noreply.github.com> Date: Tue, 15 Sep 2026 14:00:57 -0700 Subject: [PATCH 1/2] docs(agentid-sign-in): separate the credential lifetimes and point at the saved-sessions page The guide stated one lifetime (30 days from activation) and nothing about the other objects a sign-in creates, so integrators read 30 days and 180 days as the same thing, or read a remembered approval as proof a key still works. It also never said where a saved session can be inspected or forgotten, or that revoking a key leaves a provider's own session intact. Both came up in integration reports on 2026-09-10 and 2026-09-15. Adds a lifetimes table (bearer key, pending and active sign-in key, remembered approval, tokens, provider session: who creates it, who holds it, how long, what ends it, what survives), a short section on sessions saved in the client that points at https://auth.agentid.com/sessions and says it lists only that client's sessions, and the troubleshooting case "I revoked a key but an agent is still signed in". Numbers mirror agentmail-api: BROWSER_ENROLLMENT_LIFETIME_SECONDS and BROWSER_CREDENTIAL_LIFETIME_SECONDS (browser-enrollment-control.ts), BROWSER_RP_CONSENT_LIFETIME_SECONDS (browser-consent.ts), ID_TOKEN_TTL_SECONDS (config/oidc.ts). No endpoint or behavior is introduced. Co-Authored-By: Claude Fable 5.1 --- fern/pages/guides/agentid-sign-in.mdx | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/fern/pages/guides/agentid-sign-in.mdx b/fern/pages/guides/agentid-sign-in.mdx index c1e4d16..2f9c3e5 100644 --- a/fern/pages/guides/agentid-sign-in.mdx +++ b/fern/pages/guides/agentid-sign-in.mdx @@ -173,3 +173,28 @@ An active sign-in key expires 30 days after activation. To rotate, create and ac For keys your application generates and stores itself, see [AgentID Public-Key Authentication](https://docs.agentmail.to/agentid-public-key-authentication). + +## Credential lifetimes + +A sign-in involves several objects with separate lifetimes. Ending one does not end the others. + +| Object | Created by | Held by | Lifetime | Ends when | Unaffected | +| --- | --- | --- | --- | --- | --- | +| Bearer API key | You, in the console or with [Create API Key](https://docs.agentmail.to/api-reference/api-keys/create) | AgentMail | Until deleted, or its own `expires_at` | `DELETE /v0/api-keys/{api_key_id}` | Every sign-in key it created | +| Pending sign-in key | Connect or authorize, using that bearer key | AgentMail, until the client activates it | At most five minutes, sooner if the sign-in expires | Activation, expiry, or `DELETE` (cancel) | Nothing depends on it yet | +| Active sign-in key | The client that completed the sign-in, by activating the pending key | AgentMail records the public key; the private material stays in that client | 30 days from activation | Expiry, or `DELETE` (revoke) | Tokens already issued, the remembered approval, the provider's session | +| Remembered approval | The first approved sign-in of an inbox at a provider | AgentID | 180 days from the most recent sign-in, per inbox and provider | Lapse, or the provider changes its redirect URI or scopes and asks again | The provider's session, and any key | +| ID and access tokens | AgentID, when the provider redeems the authorization code | The provider | Ten minutes; there is no refresh token | Expiry | The provider's session | +| Provider session | The provider, after its callback succeeds | The provider | The provider's choice | Sign-out at the provider, or its own expiry | Nothing on AgentMail | + +The two long lifetimes are different objects. A 30-day sign-in key is a credential; a 180-day remembered approval is consent. A remembered approval does not prove a key is still usable, and revoking a key does not clear the approval. There is no endpoint to revoke a remembered approval. + +### Sessions saved in a client + +The client that completed a sign-in keeps the private half of its sign-in key as a saved session. AgentID lists those sessions at [https://auth.agentid.com/sessions](https://auth.agentid.com/sessions). The page shows the sessions saved in the client that opens it, so open it from the client that completed the sign-in; another client shows none. + +Forgetting a session there removes the local material from that client only. To revoke the credential itself, delete its key with `DELETE /v0/api-keys/{api_key_id}` as in the table above. Providers keep the sessions they issued until those expire or you sign out there. + +### I revoked a key, but an agent is still signed in at a provider + +Revocation stops new sign-ins with that key. It does not end sessions the provider already issued. AgentID sends no revocation webhook and no back-channel logout, an ID token already issued stays valid until it expires ten minutes after issue, and the provider decides its own session length. Sign out at the provider, or wait for that session to expire. A provider that re-reads AgentID's UserInfo endpoint inside those ten minutes sees the revocation sooner. From 6a22215eff5eac5078924f282a2d87eb2b03dcfd Mon Sep 17 00:00:00 2001 From: Sidharth Reddy <70673367+sidharth0612@users.noreply.github.com> Date: Tue, 15 Sep 2026 14:09:35 -0700 Subject: [PATCH 2/2] docs(agentid-sign-in): say plainly that a session is cleared in the browser at auth.agentid.com/sessions Co-Authored-By: Claude Fable 5.1 --- fern/pages/guides/agentid-sign-in.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fern/pages/guides/agentid-sign-in.mdx b/fern/pages/guides/agentid-sign-in.mdx index 2f9c3e5..205a731 100644 --- a/fern/pages/guides/agentid-sign-in.mdx +++ b/fern/pages/guides/agentid-sign-in.mdx @@ -189,11 +189,11 @@ A sign-in involves several objects with separate lifetimes. Ending one does not The two long lifetimes are different objects. A 30-day sign-in key is a credential; a 180-day remembered approval is consent. A remembered approval does not prove a key is still usable, and revoking a key does not clear the approval. There is no endpoint to revoke a remembered approval. -### Sessions saved in a client +### Clear a session in the browser -The client that completed a sign-in keeps the private half of its sign-in key as a saved session. AgentID lists those sessions at [https://auth.agentid.com/sessions](https://auth.agentid.com/sessions). The page shows the sessions saved in the client that opens it, so open it from the client that completed the sign-in; another client shows none. +The browser that completed a sign-in keeps the private half of its sign-in key as a saved session. To see and clear those sessions, open [https://auth.agentid.com/sessions](https://auth.agentid.com/sessions) in that browser and choose to forget the session there. The page lists only the sessions saved in the browser that opens it, so a different browser or profile shows none. -Forgetting a session there removes the local material from that client only. To revoke the credential itself, delete its key with `DELETE /v0/api-keys/{api_key_id}` as in the table above. Providers keep the sessions they issued until those expire or you sign out there. +Clearing a session there removes the sign-in material from that browser only. The key stays active on AgentMail until it expires or you revoke it; to revoke it, delete its key with `DELETE /v0/api-keys/{api_key_id}` as in the table above. Providers keep the sessions they issued until those expire or you sign out there. ### I revoked a key, but an agent is still signed in at a provider