Sign-in guide

How to sign in to your Axos workspace

Complete walkthrough of the Axos passwordless sign-in — six steps, eight common problems, browser compatibility notes, cookie behaviour. Read before you sign in from a new device or when something goes wrong.

The six steps

Open a modern browser. Axos supports the current and previous major versions of Chrome, Firefox, Safari, Edge and Brave on desktop and mobile. Internet Explorer is not supported. Text-mode browsers (lynx, w3m) cannot render the workspace surface but they can render the sign-in page and receive the magic link.
Navigate to axoshub.org/login. The sign-in card appears within one round-trip. If the sign-in card does not appear, the request may be rate-limited (see problem 4 below).
Enter the workspace email. This is the email address that provisioned the workspace, not any other address you may have used to correspond with support. Case is irrelevant; whitespace is trimmed.
Tap "Email me the sign-in link". The button turns to a loading state for about 1.5 seconds while the request is signed and queued on our European sync backbone. A confirmation banner appears under the button.
Check your inbox. The magic link arrives within 15 seconds under normal conditions. Subject line is "Sign in to your Axos workspace". Sender address is login@axoshub.org. The link is a single-use HTTPS URL, valid 15 minutes, with a signed token roughly 180 characters long. Copy the link if you prefer to open it in a different browser than the one that requested it.
Tap the link. The browser opens axoshub.org/workspace signed in. A first-party session cookie named ax_ws is set for 90 days, scoped to the workspace subdomain. Your notes, tasks and calendar are streamed live from the moment the workspace page renders.

Eight common problems and how to solve them

Problem 1 — The magic link email did not arrive within 15 seconds

Check the spam or promotions folder first. Around three percent of magic links land in spam on their first delivery attempt to a given address. If nothing is there, request a second link — the previous one is automatically invalidated. If the second link also fails to arrive, the address may be on a bounce list; contact support@axoshub.org from a different address and reference the workspace email you were trying to reach.

Problem 2 — Tapping the link opens a "link expired" page

The link is valid 15 minutes from the moment it was requested. If more than 15 minutes have passed, or if you have already tapped the link once, it is invalid. Return to /login and request a new one.

Problem 3 — Tapping the link opens the login page instead of the workspace

The browser blocked the session cookie. Check that third-party cookies are not disabled for axoshub.org — Axos only uses first-party cookies, but overly aggressive privacy extensions sometimes strip them anyway. Whitelist axoshub.org in the extension and request a new magic link.

Problem 4 — "Too many requests" error on the sign-in page

Our rate limit allows five magic-link requests per email per hour. If you have exceeded it (typical during a stubborn recovery loop), wait 20 minutes and try again. If you legitimately need more, contact support with your workspace email.

Problem 5 — The link opens the workspace on a different device than expected

The magic link is device-agnostic — it opens the workspace in whichever browser you tap it in. If you requested the link on your laptop and tapped it on your phone, the phone is now signed in. This is intentional; it lets you sign in on a shared or restricted device by requesting the link from a trusted one.

Problem 6 — I have 2FA turned on and the sign-in loop keeps looping

With 2FA on, tapping the magic link opens a TOTP prompt before /workspace. If your authenticator app clock is out of sync with UTC by more than 30 seconds, every code will be rejected. Re-sync the clock (Google Authenticator: menu → Time correction for codes) or use a backup code from the 2FA page.

Problem 7 — SSO users cannot use the standard magic link

If your workspace is bound to an SSO provider (Okta, Entra ID, Google Workspace, generic SAML), the standard magic link is disabled by policy. Use the SSO sign-in page or ask your workspace admin to allow magic-link fallback for your seat.

Problem 8 — I no longer control the workspace email

Passwordless sign-in requires proof of control of the workspace email. If the address is no longer yours, open a support ticket from the address you would like to migrate the workspace to, include the invoice number of any past subscription, and our support team will re-bind the workspace after identity verification (typically two working days). See also the recovery guide.

What happens after you sign in

The ax_ws session cookie is set with the Secure, HttpOnly and SameSite=Lax attributes, scoped to .axoshub.org. The cookie expires 90 days after issue and is renewed on any workspace request, so an active workspace stays signed in effectively forever. An idle workspace expires at 90 days and requires a fresh magic link to reopen.

Every active session is listed on the sessions page, with device fingerprint, IP address, first-seen and last-seen timestamps, and a "Revoke" button per row. Revocation is instant.

The cookie is scoped to axoshub.org. Signing out from the account menu (top-right of /workspace) clears the cookie in that browser only; other browsers remain signed in until their own cookie is cleared or revoked from the sessions page.