14 answers about signing in to your Axos workspace

A magic link is a one-time HTTPS URL emailed to your workspace address. Tapping it signs you in without a password. The link is valid 15 minutes and can be used once.

Passwords leak. Passwords are reused. Passwords are the number-one entry point into every SaaS breach dataset published by the ICO, the BfDI and the CNIL over the last decade. Magic links remove the shared secret entirely, so there is nothing to leak, reuse or phish in the traditional sense.

The ax_ws cookie is issued for 90 days and renewed on any workspace request. An active workspace stays signed in effectively forever; an idle workspace expires at 90 days and requires a fresh magic link.

Current and previous major versions of Chrome, Firefox, Safari, Edge and Brave on desktop and mobile. Internet Explorer is not supported. Text-mode browsers cannot render the workspace surface but can render the sign-in page.

Yes. Every device you sign in on gets its own ax_ws cookie. The list of active sessions is visible on /session-and-devices with per-row revocation.

TOTP-based second factor layered on top of the magic-link sign-in. Compatible with every RFC 6238 authenticator app. Eight one-time backup codes are issued at enrolment.

Yes, included on the Axos Business plan. Okta, Microsoft Entra ID, Google Workspace and any generic SAML 2.0 provider. SCIM 2.0 provisioning included.

Check spam first. Request a second link (the first is invalidated). If the second also fails, the address may be on a bounce list — contact support from a different address.

Five per email per hour. If you exceed the limit, wait 20 minutes and try again, or contact support if a legitimate use case requires more.

The browser blocked the session cookie. Check that first-party cookies are enabled for axoshub.org and disable overly aggressive privacy extensions on this domain, then request a new link.

No. The link is device-agnostic — it signs in whichever browser you tap it in. This is intentional and lets you sign in on a shared device by requesting the link from a trusted one.

Yes. The account menu at the top-right of /workspace has a Sign out action that clears the ax_ws cookie in that browser only. Other browsers remain signed in until revoked from /session-and-devices.

Every browser is signed out immediately. You can sign in again from any browser with a fresh magic link. Nothing is deleted — revocation is not destructive.

The workspace email is stored hashed with argon2id and used only to route magic links. The plaintext email is only held in memory while an outbound email is being composed. Even a full database dump would not disclose the plaintext addresses.