Concepts

How Accounts works

Accounts is the identity and home layer for the whole Destesi suite. Three ideas explain almost everything you’ll do here.

One identity

You have a single Destesi account. Your email and password (or a connected sign-in provider like Google or GitHub) authenticate you once. Every product trusts that same identity, so there are no separate logins to remember and no per-product credentials to rotate.

Accounts & single sign-onHow signing in once carries you across the suite.

One workspace

A workspace is the unit of collaboration and the place all your data lives. Every product is workspace-scoped: your preview environments, database branches, chats, videos, voices, images, and files all belong to a workspace, not to you personally.

A personal workspace is created automatically when you sign up, so you can start working immediately. You can create more workspaces, rename them, invite teammates, and switch between them. Your active workspace travels with your session — when you move from one product to another, you stay in the same workspace.

WorkspacesThe shared container for data, members, and billing.

Single sign-on across products

When you open a product, Accounts performs a short, invisible handoff: it mints a one-time exchange token for that product, the product redeems it for its own short-lived session, and you arrive already signed in. Behind the scenes, each product asks Accounts whether your session is still valid; sessions refresh silently, so you don’t get bounced back to login mid-task.

Your sign-in cookie is host-only — it belongs to the Accounts origin alone, which is why every other product does the exchange handshake rather than reading your cookie directly. This keeps your session isolated and consistent everywhere.

Where Accounts sits in the suite

                ┌─────────────────────────────┐
                │          Accounts            │
                │  identity · workspaces ·     │
                │  members · sessions · tokens │
                └──────────────┬──────────────┘
                               │ single sign-on
        ┌──────────────┬───────┴───────┬──────────────┐
        ▼              ▼               ▼              ▼
     Preview        Chat            Studio          Drive
   Code Review      TTS           Image gen        Connect
      Snap         Design          Commerce        Console
     Deploy          ...              ...            ...

Accounts is the source of truth for who you are, what workspace you’re in, and whether your session is valid. Each product reads that and scopes everything it does to your active workspace.

Two neighbouring Platform products complete the picture:

ConnectConnect third-party credentials (GitHub, social, stock media) once per workspace. Products fetch them at call time — they're never stored per-app.

DriveEvery artifact any product creates — videos, audio, images, files — is registered in one workspace library.

Sessions, in plain terms

Your sign-in session (the master session) is long-lived and is what keeps you logged in to Accounts. It lives in a host-only cookie on the Accounts origin.
Product sessions are short-lived and per-product. They’re created by the SSO handoff and refreshed silently against your sign-in session, so you never notice them.
You can see every active session — and revoke any of them — from Security in the account sidebar.

Ask AI