Sign-ins and tokens
How signing in works on your Mac and in the web app, how long each lasts, and how keys are protected.
Signing in on your Mac
showreel loginasks the service for a short code and opens a browser.- The browser shows the same code. You sign in with Google.
- The terminal receives a sign-in for your account and keeps it in
~/.showreel/auth.json, readable only by your user account.
The code lasts ten minutes. The sign-in lasts 30 days.
There is no sign-out command. To remove a Mac's sign-in sooner, delete ~/.showreel/auth.json.
Signing in to the web app
The web app keeps you signed in with a cookie that scripts on the page cannot read. It lasts seven days. Sign out in the header ends it. Changes made through the web app must come from the web app itself, so another site cannot make them on your behalf.
Opening the web app from your Mac
The local app uses a one-time code that works once, for one minute. Your account's sign-in never appears in a web address. If the browser is signed in as someone else, it asks before switching. See Open the web app from your Mac.
When someone is removed
Removing someone from the organisation signs them out everywhere at once, whatever sign-ins they still hold. See Remove someone.
Cloud recordings
Each cloud recording gets a token that works only for that one recording while it runs, and for nothing after it. A Google Cloud token or app sign-in sent with a recording travels sealed and is deleted once the recorder has it.
Keys the service keeps
- The organisation's Claude API key is checked with Anthropic, sealed (encrypted) and never shown again, only its last four characters.
showreel org writing set-keyreads it without showing it, so it stays out of your shell history. - Own voice keys are sealed, never sent to a Mac, and never shown to anyone.
- The licence key is shown in full to owners and admins, and as its last four characters to everyone else.