Availability
#Sign-in and authenticated session and device management are for existing verified users. Registration, verification, recovery, public privacy, and public terms are closed. Local reading does not require an account.
Native session exchange is implemented behind explicit App Attest routes. The iOS account login interface remains disabled until the signed TestFlight and real-device acceptance matrix is complete; operators must not enable it based only on unit or unsigned-build results.
Prerequisites
#- An existing verified Yomira account
- A valid sign-in path
- Two-factor authentication when required to create a trusted session
Steps
#- Sign in only through the available existing-user path.
- Complete the required authentication and two-factor gate.
- Review your own active sessions and device labels in account settings.
- Revoke a session or device you no longer recognize.
- Sign out locally when you are finished on a shared device.
Expected result
#A verified user can identify and revoke their own sessions and devices. Two-factor authentication gates trusted session creation, while normal trusted refresh stays quiet. Revoking a device also revokes its bound App Attest credential, native sessions, and app client key in one server-side operation. When iOS revokes its current device or current session, it clears the Keychain session, account/device caches, private auth cookies, and Rust snapshot.
Recovery
#If native refresh reports re-enrollment required, the client discards the unusable stored key identifier and requires a new App Attest enrollment after the next successful password/two-factor gate. Device migration, backup restore, reinstallation, and key loss can also require re-enrollment.
If logout cannot be signed or the network request fails, iOS still clears all local cloud credentials and the Rust snapshot; it never falls back to an unsigned logout. Revoke the remaining server session from another authenticated device if needed. Do not use saved registration, verification, or recovery links while those actions are closed. Never copy tokens, cookies, challenges, assertions, receipts, key identifiers, TOTP codes, or backup codes into a troubleshooting message.
Product proof
#The public launch surface explains account features only for existing verified users. It does not display a sample account, fabricated session list, or verification success state as product proof.
Support and verification
#This guide reflects the checked-in native App Attest route, rotation, revocation, and Keychain contracts. Signed TestFlight and real-device acceptance remain required before native login is exposed. The public build number is not published.
For an unresolved session problem, preserve only the device label, time of the visible event, broad public error code, and non-sensitive request correlation identifier. Use Troubleshooting and build information without sharing passwords, cookies, tokens, client keys, App Attest security objects, TOTP codes, or backup codes.