Sign-in, sign-up and access

Access to XICBOT runs through the app at app.xicbot.de. Without a session only the access pages open there, and every work area leads to sign-in. This page describes each field, message and limit, from creating an account to accepting a team invitation.

The access pages

The Sign in and Create account entries in the header of xicbot.de lead to /anmelden and /registrieren and pass on the language of the page you were reading. The links in the emails carry a language as well: the confirmation email uses the language of the account, the reset email the language of the page where the link was requested, and the invitation the language of the person who sent it. A language counts as chosen on this device if it was set with the language button, through an address with ?sprache=de or ?sprache=en as used by these entries, or earlier on this device. Only that language is sent by the sign-in page, German or English, and every successful sign-in sets it as the account language. Without a choice on this device the page sends no language; the account keeps its own, and the application takes it over after sign-in. The confirmation email, the email after a password change and the invitations the person sends follow it.

Which language the app shows and how an address can set it is described under Interface language.

Creating an account

The Create account page opens with the line “Create an account. The address is confirmed via a link before the first assistant is built.” Below the form, “Already have an account?” with Sign in leads to the sign-in page.

What is kept is the base form of your address: without surrounding spaces, in lower case and without any suffix after a plus sign, and for some large mailbox providers also without dots before the @. Max.Muster+shop@example.com thus becomes max.muster@example.com. A domain with umlauts is kept in its ASCII form, so info@müller-bau.invalid becomes info@xn--mller-bau-q9a.invalid; you can sign in with either spelling. XICBOT does not accept umlauts before the @ or a domain without a dot, because no message can be delivered to such an address; the field reports it as invalid. An address whose part before the @ is in quotation marks stays as it is. If the base form is already taken, no second account can be created. You can sign in with any spelling that leads to the same base form; the confirmation goes to the base form.

1. 1

   Step 1

   Check in the browser

   If a required field is empty or the passwords differ, the page marks the fields and reports “Please check the marked fields.” Nothing is sent in that case.

2. 2

   Step 2

   Account and login are created

   The server checks the fields again. It creates an account named after Company or project and your login with the Owner role. What each role may do is described under Team and roles.

3. 3

   Step 3

   Confirmation email

   A confirmation link valid for 48 hours is sent to the address. If sending fails, the account is kept anyway and the next page says so; you can request a new message after signing in.

4. 4

   Step 4

   Confirm your address page

   The app switches to Confirm your address with the text “We sent you a confirmation link. Open it to activate your account.” At this point you are not signed in yet.

Sign-up messages

If the server rejects a field, the message appears at that field and combines the field name with a rule, for example “Email address is already taken.” or “Password must contain at least one digit.” Above the form the page then shows “Please check the marked fields.” The rules read:

• “is required.” - the field is empty.
• “is not a valid email address.”
• “is already taken.”
• “is too long.” and “is too short.” - the length limit from the table is exceeded or not reached.
• “must contain at least one letter.” and “must contain at least one digit.” - the password rule is not met.

If the service does not respond, the page shows “The service is not responding right now.” More than 5 attempts per minute or 20 per hour from the same connection are answered with “Too many attempts. Please wait a moment.” A connection means the single address for IPv4 and the /64 network for IPv6.

Confirming your address

The link in the email opens Confirm your address with the line “We check the link from the email and unlock the account.” It is valid for 48 hours and works once. Once a newly requested message goes out, older links that have not been used become invalid.

Every state shows Sign in below it. Confirming does not sign you in by itself. More than 30 requests per minute from the same connection are rejected; this limit is shared with saving a new password.

Before confirmation

You can sign in before confirming. The app then shows the banner Email address not confirmed yet with the text “Until you confirm, assistants, knowledge, conversations and analytics stay locked. Open the link from our message - or have it sent again.” All other work areas are locked as well, such as setup, tools, team and billing; there the app shows “This area stays locked until the email address is confirmed.” Sign out and the account settings under Account security remain available: password, two-step verification, Signed-in devices and Recent sign-ins. From the Administration role upward, API keys and webhooks can be created and changed as well, provided the plan includes the API; existing ones can be revoked and deleted even without it. A team invitation can also be accepted before confirming; the address then counts as confirmed.

Each new link is valid for another 48 hours; older unused links expire at the same moment. If the message does not go out, no new link is created and a previous link that is still valid stays valid.

Signing in

The Sign in page opens with “Sign in with your email address. If two-step verification is active, the one-time code follows.”

Below the form come “or”, “No account yet?” with the Create account button and the Accessibility link. After a successful sign-in the app opens the page you came from: an address you opened, for example from an email or a bookmark, the page on which the session ended, or an open invitation. The ?sprache= addition is dropped. After signing out yourself and when a takeover ends there is no return; without a target the app opens its start page.

The second step

1. 1

   Step 1

   Password checked

   If the login has a second step set up, the server first checks address and password. If both match, the password field disappears and the password is not sent again.

2. 2

   Step 2

   Code or key

   The page asks “Please enter the code from your authenticator app.” or, when only a security key is set up, “Please confirm the sign-in on your security key.” With both set up, the code prompt appears and both ways are offered.

3. 3

   Step 3

   Time limit

   The second step is valid for 10 minutes, only from the same connection and for at most 5 failed attempts. After that the page shows “The sign-in has expired. Please enter your password again.” and sign-in starts over.

4. 4

   Step 4

   Without the device

   Below the form it says “Device not at hand?”. If the account still has recovery codes, the hint names that route and, for when none are left, the address mail@xicbot.de; otherwise only the address. After a check, two-factor authentication for the account can be reset.

You set up the authenticator app and security keys under Account security.

Sign-in messages

Limits on failed attempts

• Per address and connection: 5 failed attempts per minute and 20 per hour. Wrong codes count too. A successful sign-in resets this counter.
• Per connection across all addresses: 30 failed attempts per minute and 300 per hour. Wrong passwords and unknown addresses count here. A successful sign-in does not reset this counter.
• A connection means the single address for IPv4 and the /64 network for IPv6.

The lock applies to the connection the failed attempts come from, not to the login: someone on a different connection with the correct password can still sign in. The API states the waiting time in seconds in the retry_in field.

Session and signing out

Each sign-in lasts 30 days. Sign out sits at the right of the header bar; what else the bar holds is described under Header bar.

• The sign-in is kept in the browser's storage and survives closing the tab and the browser. It ends after 30 days, when you choose Sign out, when the password is reset or when the password is changed on another device.
• Sign out ends only the sign-in in this browser; other devices stay signed in. The browser removes the sign-in even if the server has already discarded it. The Sign in page opens afterwards.
• All tabs of the same browser share one sign-in. If you sign out in one tab or set a new password there through the link for the login that is signed in, the others show “The session was ended in another window. Please sign in again.”; if one tab signs in, the others adopt that sign-in.
• If the server rejects a sign-in, for example after the 30 days have passed, “Your session has expired. Please sign in again.” appears on the Sign in page, in that tab and in the other tabs of the same browser as well. The rejection ends only the sign-in the request was made with: if a new sign-in has happened in another tab in the meantime, that new sign-in stays.
• The account status is checked on every request. If the account is locked, the app shows “This account is locked. Please write to mail@xicbot.de.”
• An hourly maintenance run deletes expired sign-ins, expired reset links and expired confirmation links that were not redeemed. A redeemed confirmation is kept as proof.

Account security shows which devices are signed in.

Switching accounts

If your login belongs to more than one account, you switch via Switch account in the header bar. The role applies per account, and a switch applies to the whole login, on other devices too. What the list looks like, what happens on a switch and which limits apply is described under Switching accounts.

How roles are assigned is described under Team and roles.

Forgotten password

Forgot your password? on the sign-in page leads to Reset password: “We send a link to the stored address that lets you set a new password.”

1. 1

   Step 1

   Enter the address

   “Enter the email address you sign in with.” The Email address field is required, and the button is called Request link.

2. 2

   Step 2

   Confirmation

   The page answers “If an account exists for this address, the link is on its way. It is valid for 60 minutes and can be used once.” whether an account exists or not. When a new email goes out, it replaces the previous link.

3. 3

   Step 3

   Limits

   More than 3 requests per hour for the same address from the same connection, or more than 20 per hour from the same connection across all addresses, are answered with “Too many attempts. Please wait a moment.” Each mailbox receives at most 10 emails per hour; beyond that the page answers as usual but sends nothing, and the last link delivered stays valid.

Back to sign-in returns to Sign in.

Setting a new password

The link in the email opens New password: “Choose a new password. All open sessions of this account are ended in the process.” The fields are Password and Repeat password, the same rule as at sign-up applies, and the button is called Save password.

Back to sign-in is shown below the form in every state.

Accepting a team invitation

Invited people receive an email with a link to /einladung. The invitation is valid for 7 days and carries one of the roles Read, Edit or Administration; Owner is transferred, not invited. The Accept invitation page opens with “This link leads into a team. Choose a password - your address is already set and cannot be changed here.” Below it a line shows the team, the invited address and the role; if the team name is missing, it reads Team.

If, after accepting, switching into the inviting account fails, or loading the session fails where Team would open next, “You are now part of the team.” stays on screen and Overview leads on; the link reloads the application. The invitation has then already been accepted and cannot be accepted a second time. More than 20 requests per minute from the same connection are rejected. Sending and withdrawing invitations is described under Team and roles.

Via the API

Every step on this page runs through the API at https://app.xicbot.de/api/v1/. Signed-in calls carry the token in the header Authorization: Bearer …. Details are under API authentication, API: account and API limits.

Frequent questions