Security and access

Open Security and access beneath your account. This page manages your own access, separate from company roles or employee desk phones.

Browser sessions

Sessions list the browser, operating system, dashboard and last activity when available. The current session is marked. Sign out a specific session, or end every other session while keeping this one open. Ending the current session returns you to sign-in.

Names come from the browser’s reported identity and are descriptive, not proof of a physical device. Activity is updated at most once per minute. Older sessions may have no recorded start time. Company sessions expire after at most eight hours.

Passkeys

1. Select Add passkey and give it a recognizable name.
2. Confirm your current password and a fresh six-digit authenticator code.
3. Follow your browser’s fingerprint, face, device PIN or security-key prompt.

When signing in with a company account, enter your password, then choose Use a passkey instead of an authenticator code. This is a second-factor flow; it does not remove the password step. Authenticator and recovery-code sign-in remain available.

The four test dashboard domains share the overtone-test.sayram.systems passkey relying party. Verification still checks the exact dashboard origin. A passkey registered on the test environment cannot sign in to production.

Removal requires your password and a fresh authenticator code. Canceling the browser prompt creates no credential. If a request times out, refresh the passkey list before adding another.

Personal access tokens

Tokens let an agent use selected company API operations without your password, browser session or authenticator secret. Choose permissions, set an expiration, confirm your identity, then copy the secret shown once. See Agent API for setup and endpoint details.

Revoking a token ends its future access immediately. Password changes, account recovery that changes the password, email changes and account enable/disable changes invalidate existing personal tokens and remove registered company passkeys. Register new credentials after you sign in again.

Authenticator and recovery

Replace lost or exposed recovery codes from the recovery section. Previous codes stop working. Store the newly shown codes privately, separate from your normal sign-in device.

Account-linked sign-in

If your company membership uses an Overtone Account, its parent Account remains the sign-in authority. The company page links to Account security instead of enrolling a second set of company credentials. Company browser session controls and interface preferences still work. Company passkeys and long-lived personal tokens currently require native company sign-in; Account-linked delegation is not implemented.