Separate service sessions
A sibling service cannot read or reuse another service’s host-only cookie.
Account security
Contained by design.
SVCS First keeps one canonical identity while every service holds a separate host-only session.
Current status
Sign in to review security
No account or session details are exposed while signed out.
Exact return addresses
One-time codes, S256 PKCE, state, and exact registered callbacks protect every handoff.
Current authority
Party, workspace, resource, and capability access are rechecked for protected operations.
Short-lived proof
Actor tokens stay server-side and cannot outlive the validated session that created them.