Sign-ins and tokens
How signing in works on your Mac and in the web app, how long each lasts, and how keys are protected.
Signing in on your Mac
showreel loginasks the service for a short code and opens a browser.- The browser shows the same code. You sign in with Google, or with your company's own sign-in if your organisation uses single sign-on.
- The terminal receives a sign-in for your account and keeps it in
~/.showreel/auth.json, readable only by your user account.
The code lasts ten minutes. The sign-in lasts 30 days.
To sign a Mac out, run showreel logout: the sign-in ends on the service at once, and the Mac forgets it. Deleting ~/.showreel/auth.json is not enough on its own: the sign-in would still work until it expires or is ended.
Where you are signed in
Every sign-in, on a Mac or in a browser, is a session the service checks each time it is used, so ending one works at once. The web app's Account page lists yours: where, when you signed in and when it was last used. End stops any one of them, and Sign out everywhere stops them all, this one too.
Signing in to the web app
The web app keeps you signed in with a cookie that scripts on the page cannot read. It lasts seven days. Sign out in the header ends it, on the service as well as in the browser. Changes made through the web app must come from the web app itself, so another site cannot make them on your behalf.
Opening the web app from your Mac
The local app uses a one-time code that works once, for one minute. Your account's sign-in never appears in a web address. If the browser is signed in as someone else, it asks before switching. See Open the web app from your Mac.
When someone is removed
Removing someone from the organisation ends every sign-in they hold, at once. If they are invited back later, they sign in again: their old sign-ins stay ended. See Remove someone.
Cloud recordings
Each cloud recording gets a token that works only for that one recording while it runs, and for nothing after it. A Google Cloud token or app sign-in sent with a recording travels sealed and is deleted once the recorder has it.
Keys the service keeps
- The organisation's Claude API key is checked with Anthropic, sealed (encrypted) and never shown again, only its last four characters.
showreel org writing set-keyreads it without showing it, so it stays out of your shell history. - Own voice keys are sealed, never sent to a Mac, and never shown to anyone.
- The licence key is shown in full to owners and admins, and as its last four characters to everyone else.