Skip to content

Accounts and security

You will learn sign-in, sessions, and account controls.

Sign in

  1. Open the Cordo web app.
  2. On Sign in to Cordo, enter Email and Password.
  3. Click Sign in.

There is no public self-serve sign-up, OAuth, or MFA in the product today. Accounts are provisioned; an admin can then invite you to a workspace or to a specific stream.

Workspaces and streams

A workspace is the team boundary. It contains streams and workspace members (owner, admin, or member).

A stream lives in one workspace. Visibility is:

  • Private — only people invited to that stream (plus workspace owners/admins).
  • Team — every workspace member can query it, unless they have an explicit narrower stream role.

Stream roles are ranked: browse, query, views, ingest keys, settings, admin. Each role includes the ones below it.

Saved views have a separate visibility setting: Private (creator only) or Stream (anyone who can query that stream). Opening a shared view never grants ingest keys or stream admin. See Views.

Invitations

Workspace owners and admins invite by email from Settings → Members. Stream admins can invite someone to one stream from the stream’s Members panel. Accepting a stream invite also adds workspace membership when needed. There is still no public sign-up — the invitee must already have a provisioned account with the same email.

Pending invitations appear in member lists until they are accepted, declined, or cancelled.

Sessions

After sign-in, the app keeps you authenticated with a short-lived access token and a refresh cookie. Refresh happens automatically in the background — you do not configure tokens in Settings.

If your session expires and refresh fails, you return to the sign-in page.

Sign out

In the sidebar footer, click Sign out next to your email. That ends the session and returns you to /login.

What you manage in Settings

The Settings section currently exposes:

  • Members — workspace invitations and roles
  • API tokens — personal access tokens for REST and MCP (lxp_…)

There is no separate profile or password-change page in the app today. Stream ingest secrets live under Streams → API keys, not Settings.

Security habits

  • Treat stream API keys and PATs like passwords; copy them once and store them in a secret manager.
  • Prefer short-lived or environment-named keys so revoke is obvious.
  • Use PATs for agents; use stream API keys for log shippers.

Next