Open a bounded session for assisted access
An authorized administrator can create a time-limited link for a specific person’s account, for support or a supervised walkthrough. Wildo checks the target’s eligibility and bounds the resulting access.
The account type must opt in. Link expiry, permitted use and session duration are explicit parts of the mechanism.
Example — Reproduce a reported problem together
A support administrator creates a short-lived link for an active member’s account. The link can be withdrawn before use and cannot create an unbounded session.
For engineers
Opt the account type in
Wonder Todos declares oneOffSessionAllowed: true for members. The create endpoint separately requires an application super-administrator, rejects self-issuance and checks that the target account is active. It is not a general organization-member impersonation permission.
Name the target and lifetime
Selected fields from the controller’s actual request schema:
userId: z.string().min(1),
tokenType: ConsumableTokenTypesSchema,
consumeAt: z.enum(['EXCHANGE', 'TARGET_OPERATION']),
consumptionMode: z.enum(ConsumableToken_ConsumptionMode).optional().default(ConsumableToken_ConsumptionMode.SINGLE_USE),
maxUses: z.number().int().min(1).optional(),
expiresIn: z.object({
value: z.number().int().min(1),
unit: z.enum(['minutes', 'hours', 'days']),
}).optional().default({ value: 1, unit: 'hours' }),
resourceIdentifier: z.string().optional(),
relatedId: z.string().optional(),
Single use is the default; the contract also supports explicit consumption mode and use bounds. consumeAt selects exchange or target-operation consumption. Resource and related-record fields belong to the consumable token’s redemption contract. With TARGET_OPERATION, the response retains that token for the operation that consumes it. They do not become resource or record restrictions on the exchanged access JWT: that session uses the account’s normal authorization. Choose the consumption path for the intended operation rather than treating a targeted link as a record-only login.
Bound the session as well as the link
The create path limits duration to the smaller of the account type’s configured ceiling and the engine’s twelve-hour absolute ceiling. The shared token mint enforces the absolute maximum for every session-establishing path. Exchange rechecks the target’s eligibility and anchors the session lifetime at consumption. The issuer caps the initial access token at that deadline and carries the same deadline through refresh rotation, so a late refresh does not extend the one-off session.
Link validity and session lifetime answer different questions: how long the invitation to enter may be used, and how long the resulting session may last. One-off sessions do not consume the person’s ordinary concurrent-session slots. The revoke path withdraws outstanding one-off tokens without treating an arbitrary password-reset or invitation token as a support link.