How a support session works
Support sessions are started through WorkOS, the identity provider Photon uses for sign-in.- One account. A session signs in as one existing account. It doesn’t create a user or add anyone to your organization.
- A recorded reason. The staff member must enter a reason before the session starts. WorkOS records the reason with the session.
- 60 minutes at most. The session ends automatically after 60 minutes. Staff can end it sooner by signing out.
- No more access than the account. The session has exactly that account’s role and permissions, so it can’t do anything the account can’t.
- Attributed to the staff member. Every request in the session carries the staff member’s identity alongside the account’s.
- Clearly marked. While the session lasts, the staff member’s Dashboard shows a banner on every page that names the account they’re signed in as.
What a session can see and change
A support session sees what that account sees in the Dashboard. Photon shows secrets such as API key secrets and webhook signing secrets only when they’re created or rotated, so a support session can’t read your existing ones. Because the session has the account’s permissions, it can change anything that account can change. A session as an account with Can view can only read. See Roles and invitations for what each role can do.What you control
- Remove an account to end its access. A support session uses an existing account’s access. If you remove that account from Members, a session as that account can no longer reach your organization.
- Ask us. There’s no Dashboard setting to turn support access off or to approve each session. For questions about support access to your organization, email [email protected] from an Owner or Admin address.