Social account sign-in

Social account sign-in A sequence diagram generated by Archify. Run sign-in for @brand create SOCIAL_LOGIN job idempotency key: login:<accountId>:<minute> account → LOGIN_PENDING POST /v1/agents/:id/jobs/lease reserve device, mint lease token job + leaseId wake, open app, check state POST /v1/jobs/:id/credentials requires a live lease on a running sign-in job read secret audit: credentials released username + password, 5 min type into the real app signed in, or a challenge succeed — or needs-attention Queue the sign-in Lease and prepare Credentials, used once Outcome Admin · in the browser · Sequence participant Admin in the browser Control Plane · decides · Sequence participant Control Plane decides Jobs · DynamoDB · Sequence participant Jobs DynamoDB Vault · Secrets Manager · Sequence participant Vault Secrets Manager Farm Agent · decides how · Sequence participant Farm Agent decides how Device · real app · Sequence participant Device real app Legend request return security async trace default message

Why credentials are asked for, not delivered

  • • A job payload never contains a password
  • • The agent must hold a live lease on a running sign-in job
  • • Agent, lease, job, workspace and account are all checked

Always audited

  • • Every release writes account.credentials_released to activity
  • • CloudTrail records the vault read independently
  • • The response expires in five minutes and must not be cached

A challenge stops the job

  • • The agent reports needs-attention with a required action
  • • The device is parked so nothing else runs on it
  • • There is no bypass, and there will not be one