Accounts and guest sessions

The hosted console can expose guest and signed-in workflows. Available identity providers, verification steps, and account features depend on the deployed release and configuration, so use the options shown on the current sign-in screen rather than a static provider list.

Choose the right session

Use a guest session only for low-risk evaluation. Guest identity is browser-scoped and can be lost when storage is cleared, the browser crashes, or another device is used. Save the guest ID and relevant build IDs while work is in progress.

Sign in before work that must be retained or owner-restricted, including:

• downloading private build artifacts;
• returning from another browser or device;
• using account-scoped MCP credentials;
• managing organization resources; or
• purchasing or consuming account entitlements.

Being signed into OpenFactory does not grant access to another user’s build. A download URL that returns not found may be enforcing ownership rather than indicating that the artifact disappeared.

Guest migration

Do not assume every guest object will migrate automatically. If the console offers a claim or migration action, verify each conversation, recipe, build, VM, and download afterward. Preserve durable IDs before signing in so support can distinguish an ownership problem from missing state.

Account security

• Use an identity provider account protected by multifactor authentication where available.
• Never share session cookies, bearer tokens, MCP keys, or guest IDs.
• Generate automation credentials only for the intended account and revoke unused keys.
• Use an organization role rather than sharing a personal account.
• Sign out of shared browsers and remove downloaded artifacts that contain sensitive configuration.

Troubleshooting sign-in or ownership

Record:

1. the page URL and UTC timestamp;
2. whether the session is guest or signed in;
3. the visible account identifier, without copying secrets;
4. conversation, recipe, build, or VM IDs;
5. the HTTP status and error detail; and
6. whether the resource is visible from the original browser session.

Retrying a build does not repair an identity mismatch. Re-establish the correct owner session first.

For collaboration boundaries, see Roles and Permission Scope.