diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 0ce40f73f52..dbbad43dcc4 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -409,7 +409,7 @@ jobs:
           DOCKER_CLI_HINTS: false
       - name: Configure /etc/hosts
         run: |
-          sudo echo "127.0.0.1 host.docker.internal" | sudo tee -a /etc/hosts
+          sudo echo "127.0.0.1 huly.local" | sudo tee -a /etc/hosts
       - name: Prepare server
         run: |
           cd ./qms-tests
@@ -479,7 +479,7 @@ jobs:
           DOCKER_CLI_HINTS: false
       - name: Configure /etc/hosts
         run: |
-          sudo echo "127.0.0.1 host.docker.internal" | sudo tee -a /etc/hosts
+          sudo echo "127.0.0.1 huly.local" | sudo tee -a /etc/hosts
       - name: Prepare server
         run: |
           cd ./ws-tests
diff --git a/.vscode/launch.json b/.vscode/launch.json
index d3ee3247746..d78c98e888d 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -35,12 +35,12 @@
       "args": ["src/__start.ts"],
       "env": {
         // "FULLTEXT_URL": "http://localhost:4700",
-        "FULLTEXT_URL": "http://host.docker.internal:4702",
+        "FULLTEXT_URL": "http://huly.local:4702",
         // "MONGO_URL": "mongodb://localhost:27017",
         // "DB_URL": "mongodb://localhost:27017",
         // "DB_URL": "postgresql://postgres:example@localhost:5432",
-        "DB_URL": "postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable",
-        "GREEN_URL": "http://host.docker.internal:6767?token=secret",
+        "DB_URL": "postgresql://root@huly.local:26257/defaultdb?sslmode=disable",
+        "GREEN_URL": "http://huly.local:6767?token=secret",
         "SERVER_PORT": "3332",
         "APM_SERVER_URL2": "http://localhost:8200",
         "METRICS_CONSOLE": "false",
@@ -60,7 +60,7 @@
         "ELASTIC_INDEX_NAME": "local_storage_index",
         "UPLOAD_URL": "/files",
         "AI_BOT_URL": "http://localhost:4010",
-        "STATS_URL": "http://host.docker.internal:4900"
+        "STATS_URL": "http://huly.local:4900"
       },
       "runtimeArgs": ["--nolazy", "-r", "ts-node/register"],
       "runtimeVersion": "20",
@@ -79,8 +79,8 @@
         "FULLTEXT_URL": "http://localhost:4710",
         // "DB_URL": "mongodb://localhost:27018",
         // "DB_URL": "postgresql://postgres:example@localhost:5432",
-        "DB_URL": "postgresql://root@host.docker.internal:26258/defaultdb?sslmode=disable",
-        // "GREEN_URL": "http://host.docker.internal:6767?token=secret",
+        "DB_URL": "postgresql://root@huly.local:26258/defaultdb?sslmode=disable",
+        // "GREEN_URL": "http://huly.local:6767?token=secret",
         "SERVER_PORT": "3335",
         "METRICS_CONSOLE": "false",
         "METRICS_FILE": "${workspaceRoot}/metrics.txt", // Show metrics in console evert 30 seconds.,
@@ -92,7 +92,7 @@
         "ACCOUNTS_URL": "http://localhost:3003",
         "MODEL_JSON": "${workspaceRoot}/models/all/bundle/model.json",
         "MODEL_VERSION": "0.7.1",
-        "STATS_URL": "http://host.docker.internal:4901"
+        "STATS_URL": "http://huly.local:4901"
       },
       "runtimeArgs": ["--nolazy", "-r", "ts-node/register"],
       "runtimeVersion": "20",
@@ -113,13 +113,13 @@
         "FULLTEXT_DB_URL": "http://localhost:9200",
         // "DB_URL": "mongodb://localhost:27017",
         // "DB_URL": "postgresql://postgres:example@localhost:5432",
-        "DB_URL": "postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable",
+        "DB_URL": "postgresql://root@huly.local:26257/defaultdb?sslmode=disable",
         "STORAGE_CONFIG": "minio|localhost?accessKey=minioadmin&secretKey=minioadmin",
         "SERVER_SECRET": "secret",
         "REKONI_URL": "http://localhost:4004",
         "MODEL_JSON": "${workspaceRoot}/models/all/bundle/model.json",
         "ELASTIC_INDEX_NAME": "local_storage_index",
-        "STATS_URL":"http://host.docker.internal:4900",
+        "STATS_URL":"http://huly.local:4900",
         "ACCOUNTS_URL": "http://localhost:3000",
       },
       "runtimeArgs": ["--nolazy", "-r", "ts-node/register"],
@@ -138,14 +138,14 @@
       "env": {
         "MONGO_URL": "mongodb://localhost:27017",
         "DB_URL": "mongodb://localhost:27017",
-        // "DB_URL": "postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable",
+        // "DB_URL": "postgresql://root@huly.local:26257/defaultdb?sslmode=disable",
         "SERVER_SECRET": "secret",
         "REGION_INFO":"|Mongo;cockroach|CockroachDB",
-        "TRANSACTOR_URL": "ws://host.docker.internal:3333,ws://host.docker.internal:3332;;cockroach",
+        "TRANSACTOR_URL": "ws://huly.local:3333,ws://huly.local:3332;;cockroach",
         "ACCOUNTS_URL": "http://localhost:3000",
         "ACCOUNT_PORT": "3000",
         "FRONT_URL": "http://localhost:8080",
-        "STATS_URL": "http://host.docker.internal:4900",
+        "STATS_URL": "http://huly.local:4900",
         "SES_URL": "",
         // "DB_NS": "account-2",
         // "WS_LIVENESS_DAYS": "1",
@@ -172,11 +172,11 @@
         // "DB_URL": "postgresql://postgres:example@localhost:5432",
         "SERVER_SECRET": "secret",
         "REGION_INFO":"|Mongo;pg|Postgres;cockroach|CockroachDB",
-        "TRANSACTOR_URL": "ws://host.docker.internal:3334;;,ws://host.docker.internal:3335;;europe", 
+        "TRANSACTOR_URL": "ws://huly.local:3334;;,ws://huly.local:3335;;europe", 
         "ACCOUNTS_URL": "http://localhost:3003",
         "ACCOUNT_PORT": "3003",
         "FRONT_URL": "http://localhost:8083",
-        "STATS_URL": "http://host.docker.internal:4901",
+        "STATS_URL": "http://huly.local:4901",
         "SES_URL": "",
         // "DB_NS": "account-2",
         // "WS_LIVENESS_DAYS": "1",
@@ -216,7 +216,7 @@
       "env": {
         "DB_URL": "mongodb://localhost:27017",
         // "DB_URL": "postgresql://postgres:example@localhost:5432",
-        // "DB_URL": "postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable",
+        // "DB_URL": "postgresql://root@huly.local:26257/defaultdb?sslmode=disable",
         
         "REGION": "",
         "SERVER_SECRET": "secret",
@@ -249,8 +249,8 @@
       "env": {
         // "DB_URL": "mongodb://localhost:27017",
         // "DB_URL": "postgresql://postgres:example@localhost:5432",
-        "DB_URL": "postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable",
-        "FULLTEXT_URL": "http://host.docker.internal:4702",
+        "DB_URL": "postgresql://root@huly.local:26257/defaultdb?sslmode=disable",
+        "FULLTEXT_URL": "http://huly.local:4702",
         "REGION": "cockroach",
         "SERVER_SECRET": "secret",
         "TRANSACTOR_URL": "ws://localhost:3332",
@@ -415,7 +415,7 @@
         "ACCOUNT_DB_URL": "mongodb://localhost:27017",
         // "ACCOUNT_DB_URL": "postgresql://postgres:example@localhost:5433",
         // "DB_URL": "postgresql://postgres:example@localhost:5433",
-        "DB_URL": "postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable",
+        "DB_URL": "postgresql://root@huly.local:26257/defaultdb?sslmode=disable",
         "MONGO_URL": "mongodb://localhost:27017",
         "TELEGRAM_DATABASE": "telegram-service",
         "REKONI_URL": "http://localhost:4004",
@@ -514,7 +514,7 @@
         "PLATFORM_OPERATION_LOGGING": "true",
         "FRONT_URL": "http://localhost:8080",
         "PORT": "3500",
-        "STATS_URL": "http://host.docker.internal:4900"
+        "STATS_URL": "http://huly.local:4900"
       },
       "runtimeArgs": ["--nolazy", "-r", "ts-node/register"],
       "sourceMaps": true,
diff --git a/README.md b/README.md
index 3f50824cf1e..6335127895b 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,8 @@ This project offers a convenient method to host Huly using `docker`, designed fo
   - [Table of Content](#table-of-content)
   - [Pre-requisites](#pre-requisites)
   - [Verification](#verification)
+  - [Fast start](#fast-start)
+  - [Branches \& Contributing](#branches--contributing)
   - [Installation](#installation)
   - [Build and run](#build-and-run)
   - [Run in development mode](#run-in-development-mode)
@@ -149,10 +151,10 @@ sh ./scripts/create-workspace.sh
 Add the following line to your /etc/hosts file
 
 ```plain
-127.0.0.1 host.docker.internal
+127.0.0.1 huly.local
 ```
 
-Accessing the URL <http://host.docker.internal:8087> will lead you to the app in development mode.
+Accessing the URL <http://huly.local:8087> will lead you to the app in development mode.
 
 Limitations:
 
diff --git a/common/config/rush/pnpm-lock.yaml b/common/config/rush/pnpm-lock.yaml
index b4c2c57fbf6..48d4de2acd4 100644
--- a/common/config/rush/pnpm-lock.yaml
+++ b/common/config/rush/pnpm-lock.yaml
@@ -1330,6 +1330,9 @@ importers:
       '@types/compression':
         specifier: ~1.7.2
         version: 1.7.5
+      '@types/cookies':
+        specifier: ^0.9.0
+        version: 0.9.0
       '@types/cors':
         specifier: ^2.8.12
         version: 2.8.17
@@ -1534,6 +1537,9 @@ importers:
       compression-webpack-plugin:
         specifier: ^10.0.0
         version: 10.0.0(webpack@5.97.1)
+      cookies:
+        specifier: ^0.9.1
+        version: 0.9.1
       copy-webpack-plugin:
         specifier: ^11.0.0
         version: 11.0.0(webpack@5.97.1)
@@ -3955,7 +3961,7 @@ packages:
     version: 0.0.0
 
   '@rush-temp/account-service@file:projects/account-service.tgz':
-    resolution: {integrity: sha512-SBWP6HBOnzpJC3MIOlYbttcjYw1HoD9VpbLpUS3zRwEL2slU6c0W/hEBU0/rzh3KkLb6bScKssS5utlSx5RrNw==, tarball: file:projects/account-service.tgz}
+    resolution: {integrity: sha512-ViPfMFYJ6+K9NPAIyV9v6+v6BRtdPCSiU4iTXCdZsoPgpag3nFxhE5PC3ahzS2wJ0TbCX+5UdaUX/UE3ySL4OA==, tarball: file:projects/account-service.tgz}
     version: 0.0.0
 
   '@rush-temp/account@file:projects/account.tgz':
@@ -16067,6 +16073,7 @@ snapshots:
   '@rush-temp/account-service@file:projects/account-service.tgz(@babel/core@7.23.9)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.23.9))(gcp-metadata@5.3.0(encoding@0.1.13))(snappy@7.2.2)(socks@2.8.3)':
     dependencies:
       '@koa/cors': 5.0.0
+      '@types/cookies': 0.9.0
       '@types/jest': 29.5.12
       '@types/koa': 2.15.0
       '@types/koa-bodyparser': 4.3.12
@@ -16075,6 +16082,7 @@ snapshots:
       '@types/node': 20.11.19
       '@typescript-eslint/eslint-plugin': 6.21.0(@typescript-eslint/parser@6.21.0(eslint@8.56.0)(typescript@5.3.3))(eslint@8.56.0)(typescript@5.3.3)
       '@typescript-eslint/parser': 6.21.0(eslint@8.56.0)(typescript@5.3.3)
+      cookies: 0.9.1
       cross-env: 7.0.3
       esbuild: 0.24.2
       eslint: 8.56.0
diff --git a/desktop/.env-dev b/desktop/.env-dev
index 037febc7837..936dd726fda 100644
--- a/desktop/.env-dev
+++ b/desktop/.env-dev
@@ -1,2 +1,2 @@
-FRONT_URL=http://localhost:8087
+FRONT_URL=http://huly.local:8087
 CONFIG_URL=config.json
diff --git a/desktop/src/main/start.ts b/desktop/src/main/start.ts
index fee9be59bcb..6c276e1aa6f 100644
--- a/desktop/src/main/start.ts
+++ b/desktop/src/main/start.ts
@@ -63,7 +63,7 @@ const serverChanged = oldFront !== FRONT_URL
 
 function readServerUrl (): string {
   if (isDev) {
-    return process.env.FRONT_URL ?? 'http://localhost:8087'
+    return process.env.FRONT_URL ?? 'http://huly.local:8087'
   }
 
   return ((settings as any).get('server', process.env.FRONT_URL) as string) ?? 'https://huly.app'
diff --git a/desktop/src/ui/index.ts b/desktop/src/ui/index.ts
index 2658d01ea9e..499a86d5f53 100644
--- a/desktop/src/ui/index.ts
+++ b/desktop/src/ui/index.ts
@@ -1,24 +1,21 @@
-import login, { loginId } from '@hcengineering/login'
-import { getEmbeddedLabel, getMetadata, setMetadata } from '@hcengineering/platform'
-import presentation, { closeClient, MessageBox, setDownloadProgress } from '@hcengineering/presentation'
+import { loginId } from '@hcengineering/login'
+import { getEmbeddedLabel, getMetadata } from '@hcengineering/platform'
+import presentation, { MessageBox, setDownloadProgress } from '@hcengineering/presentation'
 import settings, { settingId } from '@hcengineering/setting'
 import {
   closePanel,
   closePopup,
   createApp,
-  fetchMetadataLocalStorage,
-  getCurrentLocation,
   getCurrentResolvedLocation,
   navigate,
   parseLocation,
   pushRootBarProgressComponent,
   removeRootBarComponent,
-  setMetadataLocalStorage,
   showPopup
 } from '@hcengineering/ui'
 
 import { notificationId } from '@hcengineering/notification'
-import { workbenchId } from '@hcengineering/workbench'
+import { workbenchId, logOut } from '@hcengineering/workbench'
 
 import { isOwnerOrMaintainer } from '@hcengineering/core'
 import { configurePlatform } from './platform'
@@ -58,18 +55,7 @@ window.addEventListener('DOMContentLoaded', () => {
   })
 
   ipcMain.on('logout', () => {
-    const tokens = fetchMetadataLocalStorage(login.metadata.LoginTokensV2)
-    if (tokens !== null) {
-      const loc = getCurrentLocation()
-      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
-      delete tokens[loc.path[1]]
-      setMetadataLocalStorage(login.metadata.LoginTokensV2, tokens)
-    }
-    setMetadata(presentation.metadata.Token, null)
-    setMetadataLocalStorage(login.metadata.LastToken, null)
-    setMetadataLocalStorage(login.metadata.LoginEndpoint, null)
-    setMetadataLocalStorage(login.metadata.LoginAccount, null)
-    void closeClient().then(() => {
+    void logOut().then(() => {
       navigate({ path: [loginId] })
     })
   })
diff --git a/dev/branding.json b/dev/branding.json
index b35a6042a52..44b2d6d91ed 100644
--- a/dev/branding.json
+++ b/dev/branding.json
@@ -1,12 +1,12 @@
 {
-  "localhost:8080": {
+  "huly.local:8080": {
     "key": "huly-dev",
     "title": "Huly",
     "protocol": "http",
     "language": "en",
     "lastNameFirst": "true"
   },
-  "localhost:8087": {
+  "huly.local:8087": {
     "key": "huly",
     "title": "Huly",
     "protocol": "http",
@@ -20,13 +20,13 @@
     "language": "en",
     "lastNameFirst": "true"
   },
-  "localhost:8081": {
+  "huly.local:8081": {
     "key": "tracex-dev",
     "title": "TraceX",
     "protocol": "http",
     "language": "en"
   },
-  "localhost:8088": {
+  "huly.local:8088": {
     "key": "tracex",
     "title": "TraceX",
     "protocol": "http",
diff --git a/dev/docker-compose.yaml b/dev/docker-compose.yaml
index 99a9ceab8e8..99ca8cf30a3 100644
--- a/dev/docker-compose.yaml
+++ b/dev/docker-compose.yaml
@@ -3,7 +3,7 @@ services:
     image: 'mongo:7-jammy'
     container_name: mongodb
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     healthcheck:
       test: echo "try { db.currentOp().ok } catch (err) { }" | mongosh --port 27017 --quiet
       interval: 5s
@@ -61,7 +61,7 @@ services:
   account:
     image: hardcoreeng/account
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - mongodb
       - minio
@@ -74,29 +74,29 @@ services:
       - ACCOUNT_PORT=3000
       - SERVER_SECRET=secret
       - ADMIN_EMAILS=admin
-      - STATS_URL=http://host.docker.internal:4900
-      # - DB_URL=postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable
+      - STATS_URL=http://huly.local:4900
+      # - DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable
       - DB_URL=${MONGO_URL}
       # - DB_NS=account-2
       # Pass only one region to disallow selection for new workspaces.Ø
       - REGION_INFO=|Mongo;cockroach|CockroachDB
       # - REGION_INFO=cockroach|CockroachDB
-      - TRANSACTOR_URL=ws://host.docker.internal:3333,ws://host.docker.internal:3332;;cockroach,
+      - TRANSACTOR_URL=ws://huly.local:3333,ws://huly.local:3332;;cockroach,
       - SES_URL=
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - FRONT_URL=http://host.docker.internal:8087
+      - FRONT_URL=http://huly.local:8087
       - RESERVED_DB_NAMES=telegram,gmail,github
       - MODEL_ENABLED=*
       - LAST_NAME_FIRST=true
       # - WS_LIVENESS_DAYS=1
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - BRANDING_PATH=/var/cfg/branding.json
       # - DISABLE_SIGNUP=true
     restart: unless-stopped
   stats:
     image: hardcoreeng/stats
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     ports:
       - 4900:4900
     environment:
@@ -106,7 +106,7 @@ services:
   workspace:
     image: hardcoreeng/workspace
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - mongodb
       - minio
@@ -117,12 +117,12 @@ services:
       - WS_OPERATION=all+backup
       - SERVER_SECRET=secret
       - DB_URL=${MONGO_URL}
-      - STATS_URL=http://host.docker.internal:4900
+      - STATS_URL=http://huly.local:4900
       - SES_URL=
       - STORAGE_CONFIG=${STORAGE_CONFIG}
       - RESERVED_DB_NAMES=telegram,gmail,github
       - MODEL_ENABLED=*
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - BRANDING_PATH=/var/cfg/branding.json
       # - PARALLEL=2
       - BACKUP_STORAGE=${BACKUP_STORAGE_CONFIG}
@@ -132,7 +132,7 @@ services:
   workspace_cockroach:
     image: hardcoreeng/workspace
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - cockroach
       - minio
@@ -142,14 +142,14 @@ services:
     environment:
       - WS_OPERATION=all+backup
       - SERVER_SECRET=secret
-      - DB_URL=postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable
-      - STATS_URL=http://host.docker.internal:4900
+      - DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable
+      - STATS_URL=http://huly.local:4900
       - SES_URL=
       - REGION=cockroach
       - STORAGE_CONFIG=${STORAGE_CONFIG}
       - RESERVED_DB_NAMES=telegram,gmail,github
       - MODEL_ENABLED=*
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - BRANDING_PATH=/var/cfg/branding.json
       # - PARALLEL=2
       - BACKUP_STORAGE=${BACKUP_STORAGE_CONFIG}
@@ -159,7 +159,7 @@ services:
   collaborator:
     image: hardcoreeng/collaborator
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - mongodb
       - minio
@@ -170,14 +170,14 @@ services:
     environment:
       - COLLABORATOR_PORT=3078
       - SECRET=secret
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - STATS_URL=http://host.docker.internal:4900
+      - STATS_URL=http://huly.local:4900
     restart: unless-stopped
   front:
     image: hardcoreeng/front
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - mongodb
       - minio
@@ -191,28 +191,28 @@ services:
     environment:
       - SERVER_PORT=8080
       - SERVER_SECRET=secret
-      - ACCOUNTS_URL=http://host.docker.internal:3000
-      - STATS_URL=http://host.docker.internal:4900
+      - ACCOUNTS_URL=http://huly.local:3000
+      - STATS_URL=http://huly.local:4900
       - UPLOAD_URL=/files
-      - GMAIL_URL=http://host.docker.internal:8088
-      - CALENDAR_URL=http://host.docker.internal:8095
-      - TELEGRAM_URL=http://host.docker.internal:8086
-      - REKONI_URL=http://host.docker.internal:4004
-      - COLLABORATOR_URL=ws://host.docker.internal:3078
+      - GMAIL_URL=http://huly.local:8088
+      - CALENDAR_URL=http://huly.local:8095
+      - TELEGRAM_URL=http://huly.local:8086
+      - REKONI_URL=http://huly.local:4004
+      - COLLABORATOR_URL=ws://huly.local:3078
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - GITHUB_URL=http://host.docker.internal:3500
-      - PRINT_URL=http://host.docker.internal:4005
-      - SIGN_URL=http://host.docker.internal:4006
-      - ANALYTICS_COLLECTOR_URL=http://host.docker.internal:4017
+      - GITHUB_URL=http://huly.local:3500
+      - PRINT_URL=http://huly.local:4005
+      - SIGN_URL=http://huly.local:4006
+      - ANALYTICS_COLLECTOR_URL=http://huly.local:4017
       - DESKTOP_UPDATES_URL=https://dist.huly.io
       - DESKTOP_UPDATES_CHANNEL=dev
-      - BRANDING_URL=http://host.docker.internal:8087/branding.json
+      - BRANDING_URL=http://huly.local:8087/branding.json
       # - DISABLE_SIGNUP=true
     restart: unless-stopped
   transactor:
     image: hardcoreeng/transactor
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - mongodb
       - minio
@@ -230,8 +230,8 @@ services:
       - SERVER_PORT=3333
       - SERVER_SECRET=secret
       - ENABLE_COMPRESSION=false
-      - STATS_URL=http://host.docker.internal:4900
-      - FULLTEXT_URL=http://host.docker.internal:4700
+      - STATS_URL=http://huly.local:4900
+      - FULLTEXT_URL=http://huly.local:4700
       # - DB_URL=postgresql://postgres:example@postgres:5432
       - DB_URL=${MONGO_URL}
       - MONGO_URL=${MONGO_URL}
@@ -239,18 +239,18 @@ services:
       - METRICS_CONSOLE=false
       - METRICS_FILE=metrics.txt
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - FRONT_URL=http://host.docker.internal:8087
+      - FRONT_URL=http://huly.local:8087
       # - APM_SERVER_URL=http://apm-server:8200
       - SES_URL=''
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - LAST_NAME_FIRST=true
       - BRANDING_PATH=/var/cfg/branding.json
-      - AI_BOT_URL=http://host.docker.internal:4010
+      - AI_BOT_URL=http://huly.local:4010
     restart: unless-stopped
   transactor_cockroach:
     image: hardcoreeng/transactor
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - cockroach
       - minio
@@ -268,24 +268,24 @@ services:
       - SERVER_PORT=3332
       - SERVER_SECRET=secret
       - ENABLE_COMPRESSION=false
-      - FULLTEXT_URL=http://host.docker.internal:4702
-      - STATS_URL=http://host.docker.internal:4900
-      - DB_URL=postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable
+      - FULLTEXT_URL=http://huly.local:4702
+      - STATS_URL=http://huly.local:4900
+      - DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable
       - METRICS_CONSOLE=false
       - METRICS_FILE=metrics.txt
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - FRONT_URL=http://host.docker.internal:8087
+      - FRONT_URL=http://huly.local:8087
       # - APM_SERVER_URL=http://apm-server:8200
       - SES_URL=''
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - LAST_NAME_FIRST=true
       - BRANDING_PATH=/var/cfg/branding.json
-      - AI_BOT_URL=http://host.docker.internal:4010
+      - AI_BOT_URL=http://huly.local:4010
     restart: unless-stopped
   green:
     image: hardcoreeng/green
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     links:
       - cockroach
       - stats
@@ -294,8 +294,8 @@ services:
     environment:
       - PORT=6767
       - AUTH_TOKEN=secret
-      - STATS_URL=http://host.docker.internal:4900
-      - DB_URL=postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable
+      - STATS_URL=http://huly.local:4900
+      - DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable
     restart: unless-stopped    
   rekoni:
     image: hardcoreeng/rekoni-service
@@ -305,7 +305,7 @@ services:
   fulltext:
     image: hardcoreeng/fulltext
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     restart: unless-stopped
     links:
       - elastic
@@ -315,16 +315,16 @@ services:
     environment:
       - SERVER_SECRET=secret
       - DB_URL=${MONGO_URL}
-      - FULLTEXT_DB_URL=http://host.docker.internal:9200
+      - FULLTEXT_DB_URL=http://huly.local:9200
       - ELASTIC_INDEX_NAME=local_storage_index
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - STATS_URL=http://host.docker.internal:4900
-      - REKONI_URL=http://host.docker.internal:4004
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - STATS_URL=http://huly.local:4900
+      - REKONI_URL=http://huly.local:4004
+      - ACCOUNTS_URL=http://huly.local:3000
   fulltext_cockroach:
     image: hardcoreeng/fulltext
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     restart: unless-stopped
     links:
       - elastic
@@ -334,29 +334,29 @@ services:
     environment:
       - PORT=4702
       - SERVER_SECRET=secret
-      - DB_URL=postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable
-      - FULLTEXT_DB_URL=http://host.docker.internal:9200
+      - DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable
+      - FULLTEXT_DB_URL=http://huly.local:9200
       - ELASTIC_INDEX_NAME=local_storage_index
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - STATS_URL=http://host.docker.internal:4900
-      - REKONI_URL=http://host.docker.internal:4004
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - STATS_URL=http://huly.local:4900
+      - REKONI_URL=http://huly.local:4004
+      - ACCOUNTS_URL=http://huly.local:3000
   print:
     image: hardcoreeng/print
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     restart: unless-stopped
     ports:
       - 4005:4005
     environment:
       - SECRET=secret
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - STATS_URL=http://host.docker.internal:4900
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - STATS_URL=http://huly.local:4900
+      - ACCOUNTS_URL=http://huly.local:3000
   sign:
     image: hardcoreeng/sign
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     restart: unless-stopped
     ports:
       - 4006:4006
@@ -367,16 +367,16 @@ services:
       - SECRET=secret
       - MINIO_ENDPOINT=minio
       - MINIO_ACCESS_KEY=minioadmin
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - MINIO_SECRET_KEY=minioadmin
       - CERTIFICATE_PATH=/var/cfg/certificate.p12
       - SERVICE_ID=sign-service
       - BRANDING_PATH=/var/cfg/branding.json
-      - STATS_URL=http://host.docker.internal:4900
+      - STATS_URL=http://huly.local:4900
 #  analytics:
 #    image: hardcoreeng/analytics-collector
 #    extra_hosts:
-#      - 'host.docker.internal:host-gateway'
+#      - 'huly.local:host-gateway'
 #    restart: unless-stopped
 #    ports:
 #      - 4017:4017
@@ -386,32 +386,32 @@ services:
 #      - MONGO_URL=${MONGO_URL}
 #      - 'MONGO_OPTIONS={"appName":"analytics","maxPoolSize":1}'
 #      - SERVICE_ID=analytics-collector-service
-#      - ACCOUNTS_URL=http://host.docker.internal:3000
-#      - STATS_URL=http://host.docker.internal:4900
+#      - ACCOUNTS_URL=http://huly.local:3000
+#      - STATS_URL=http://huly.local:4900
   aiBot:
     image: hardcoreeng/ai-bot
     ports:
       - 4010:4010
     extra_hosts:
-      - 'host.docker.internal:host-gateway'
+      - 'huly.local:host-gateway'
     restart: unless-stopped
     environment:
       - SERVER_SECRET=secret
       - MONGO_URL=${MONGO_URL}
-      - ACCOUNTS_URL=http://host.docker.internal:3000
+      - ACCOUNTS_URL=http://huly.local:3000
       - STORAGE_CONFIG=${STORAGE_CONFIG}
       - FIRST_NAME=Jolie
       - LAST_NAME=AI
       - PASSWORD=password
       - AVATAR_PATH=./avatar.png
       - AVATAR_CONTENT_TYPE=.png
-      - STATS_URL=http://host.docker.internal:4900
-#      - LOVE_ENDPOINT=http://host.docker.internal:8096
+      - STATS_URL=http://huly.local:4900
+#      - LOVE_ENDPOINT=http://huly.local:8096
 #      - OPENAI_API_KEY=token
 #  telegram-bot:
 #    image: hardcoreeng/telegram-bot
 #   extra_hosts:
-#     - "host.docker.internal:host-gateway"
+#     - "huly.local:host-gateway"
 #    restart: unless-stopped
 #    environment:
 #      - PORT=4020
@@ -420,9 +420,9 @@ services:
 #      - MONGO_DB=telegram-bot
 #      - SECRET=secret
 #      - DOMAIN=domain
-#      - ACCOUNTS_URL=http://host.docker.internal:3000
+#      - ACCOUNTS_URL=http://huly.local:3000
 #      - SERVICE_ID=telegram-bot-service
-#      - STATS_URL=http://host.docker.internal:4900
+#      - STATS_URL=http://huly.local:4900
 volumes:
   db:
   dbpg:
diff --git a/dev/local-mongo/docker-compose.yaml b/dev/local-mongo/docker-compose.yaml
index 22b38fdf095..5576d357c23 100644
--- a/dev/local-mongo/docker-compose.yaml
+++ b/dev/local-mongo/docker-compose.yaml
@@ -40,7 +40,7 @@ services:
     environment:
       - ACCOUNT_PORT=3000
       - SERVER_SECRET=secret
-      - MONGO_URL=mongodb://host.docker.internal:27017?compressors=snappy
+      - MONGO_URL=mongodb://huly.local:27017?compressors=snappy
       - TRANSACTOR_URL=ws://transactor:3333;ws://localhost:3333
       - SES_URL=
       - STORAGE_CONFIG=${STORAGE_CONFIG}
@@ -65,7 +65,7 @@ services:
       - SECRET=secret
       - ACCOUNTS_URL=http://account:3000
       - UPLOAD_URL=/files
-      - MONGO_URL=mongodb://host.docker.internal:27017?compressors=snappy
+      - MONGO_URL=mongodb://huly.local:27017?compressors=snappy
       - 'MONGO_OPTIONS={"appName":"collaborator","maxPoolSize":2}'
       - STORAGE_CONFIG=${STORAGE_CONFIG}
     restart: unless-stopped
@@ -83,7 +83,7 @@ services:
       - UV_THREADPOOL_SIZE=10
       - SERVER_PORT=8080
       - SERVER_SECRET=secret
-      - MONGO_URL=mongodb://host.docker.internal:27017?compressors=snappy
+      - MONGO_URL=mongodb://huly.local:27017?compressors=snappy
       - 'MONGO_OPTIONS={"appName":"front","maxPoolSize":1}'
       - ACCOUNTS_URL=http://localhost:3000
       - UPLOAD_URL=/files      
@@ -120,7 +120,7 @@ services:
       - SERVER_PORT=3333
       - SERVER_SECRET=secret
       - ENABLE_COMPRESSION=true
-      - MONGO_URL=mongodb://host.docker.internal:27017?compressors=snappy
+      - MONGO_URL=mongodb://huly.local:27017?compressors=snappy
       - 'MONGO_OPTIONS={"appName": "transactor", "maxPoolSize": 10}'
       - METRICS_CONSOLE=false
       - METRICS_FILE=metrics.txt
@@ -151,7 +151,7 @@ services:
       - 4005:4005
     environment:
       - SECRET=secret
-      - MONGO_URL=mongodb://host.docker.internal:27017?compressors=snappy
+      - MONGO_URL=mongodb://huly.local:27017?compressors=snappy
       - 'MONGO_OPTIONS={"appName":"print","maxPoolSize":1}'
       - STORAGE_CONFIG=${STORAGE_CONFIG}
     deploy:
@@ -168,7 +168,7 @@ services:
       - ../../services/sign/pod-sign/debug/branding.json:/var/cfg/branding.json
     environment:
       - SECRET=secret
-      - MONGO_URL=mongodb://host.docker.internal:27017
+      - MONGO_URL=mongodb://huly.local:27017
       - 'MONGO_OPTIONS={"appName":"sign","maxPoolSize":1}'
       - MINIO_ENDPOINT=minio
       - MINIO_ACCESS_KEY=minioadmin
@@ -189,7 +189,7 @@ services:
 #    environment:
 #      - SECRET=secret
 #      - PORT=4007
-#      - MONGO_URL=mongodb://host.docker.internal:27017
+#      - MONGO_URL=mongodb://huly.local:27017
 #      - 'MONGO_OPTIONS={"appName":"analytics","maxPoolSize":1}'
 #      - SERVICE_ID=analytics-collector-service
 #      - ACCOUNTS_URL=http://account:3000
@@ -202,7 +202,7 @@ services:
     restart: unless-stopped
     environment:
       - SERVER_SECRET=secret
-      - MONGO_URL=mongodb://host.docker.internal:27017
+      - MONGO_URL=mongodb://huly.local:27017
       - ACCOUNTS_URL=http://account:3000
       - FIRST_NAME=Jolie
       - LAST_NAME=AI
@@ -219,7 +219,7 @@ services:
 #    environment:
 #      - PORT=4020
 #      - BOT_TOKEN=token
-#      - MONGO_URL=mongodb://host.docker.internal:27017
+#      - MONGO_URL=mongodb://huly.local:27017
 #      - MONGO_DB=telegram-bot
 #      - SECRET=secret
 #      - DOMAIN=domain
diff --git a/dev/prod/public/branding.json b/dev/prod/public/branding.json
index 1efd403c584..caccda656fb 100644
--- a/dev/prod/public/branding.json
+++ b/dev/prod/public/branding.json
@@ -1,5 +1,5 @@
 {
-  "localhost:8080": {
+  "huly.local:8080": {
     "title": "Huly",
     "languages": "en,ru,pt,es,zh,fr,de",
     "defaultLanguage": "en",
@@ -28,7 +28,7 @@
       }
     ]
   },
-  "localhost:8087": {
+  "huly.local:8087": {
     "title": "Huly",
     "languages": "en,ru,pt,es,zh,fr,de",
     "defaultLanguage": "en",
@@ -57,7 +57,7 @@
       }
     ]
   },
-  "localhost:8081": {
+  "huly.local:8081": {
     "title": "TraceX",
     "languages": "en",
     "defaultLanguage": "en",
@@ -97,7 +97,7 @@
       }
     ]
   },
-  "localhost:8088": {
+  "huly.local:8088": {
     "title": "TraceX",
     "languages": "en",
     "defaultLanguage": "en",
diff --git a/dev/scripts/debug_account.sh b/dev/scripts/debug_account.sh
index 0581bdf2481..8809d4bbd80 100755
--- a/dev/scripts/debug_account.sh
+++ b/dev/scripts/debug_account.sh
@@ -9,14 +9,14 @@ echo "Running account on port: ${port}"
 #MONGO_URL=mongodb://localhost:27017,
 export DB_URL="mongodb://localhost:27018"
 # DB_URL=postgresql://postgres:example@localhost:5432,
-# DB_URL=postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable,
+# DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable,
 export SERVER_SECRET="secret"
 export REGION_INFO="|America;europe|"
 export TRANSACTOR_URL="ws://transactor:3334;ws://localhost:3334,ws://transactor-europe:3335;ws://localhost:3335;europe,"
 export ACCOUNTS_URL="http://localhost:${port}"
 export ACCOUNT_PORT=${port}
 export FRONT_URL="http://localhost:8080"
-export STATS_URL="http://host.docker.internal:4900"
+export STATS_URL="http://huly.local:4900"
 export SES_URL=
 export MINIO_ACCESS_KEY="minioadmin"
 export MINIO_SECRET_KEY="minioadmin"
diff --git a/dev/tool/src/index.ts b/dev/tool/src/index.ts
index 358d39be101..7d532d0da7d 100644
--- a/dev/tool/src/index.ts
+++ b/dev/tool/src/index.ts
@@ -279,7 +279,11 @@ export function devTool (
             throw new Error(`Workspace ${workspace} not found`)
           }
 
-          await assignWorkspace(toolCtx, db, null, getToolToken(), email, ws.uuid, AccountRole.User)
+          await assignWorkspace(toolCtx, db, null, getToolToken(), {
+            email,
+            workspaceUuid: ws.uuid,
+            role: AccountRole.User
+          })
         } catch (err: any) {
           console.error(err)
         }
@@ -341,16 +345,12 @@ export function devTool (
           undefined,
           true
         )
-        await updateWorkspaceInfo(
-          measureCtx,
-          db,
-          brandingObj,
-          getToolToken(),
-          res.workspaceUuid,
-          'create-done',
+        await updateWorkspaceInfo(measureCtx, db, brandingObj, getToolToken(), {
+          workspaceUuid: res.workspaceUuid,
+          event: 'create-done',
           version,
-          100
-        )
+          progress: 100
+        })
 
         console.log('create-workspace done')
       })
@@ -372,7 +372,7 @@ export function devTool (
           throw new Error(`Workspace ${workspace} not found`)
         }
 
-        await assignWorkspace(toolCtx, db, null, getToolToken(), email, ws.uuid, role)
+        await assignWorkspace(toolCtx, db, null, getToolToken(), { email, workspaceUuid: ws.uuid, role })
       })
     })
 
@@ -423,7 +423,12 @@ export function devTool (
           true
         )
 
-        await updateWorkspaceInfo(measureCtx, db, null, getToolToken(), info.uuid, 'upgrade-done', version, 100)
+        await updateWorkspaceInfo(measureCtx, db, null, getToolToken(), {
+          workspaceUuid: info.uuid,
+          event: 'upgrade-done',
+          version,
+          progress: 100
+        })
 
         console.log(metricsToString(measureCtx.metrics, 'upgrade', 60))
         console.log('upgrade-workspace done')
diff --git a/packages/account-client/src/client.ts b/packages/account-client/src/client.ts
index dfc8e64f339..089e33001b6 100644
--- a/packages/account-client/src/client.ts
+++ b/packages/account-client/src/client.ts
@@ -107,6 +107,9 @@ export interface AccountClient {
   assignWorkspace: (email: string, workspaceUuid: string, role: AccountRole) => Promise<void>
   updateBackupInfo: (info: BackupStatus) => Promise<void>
   updateWorkspaceRoleBySocialId: (socialKey: string, targetRole: AccountRole) => Promise<void>
+
+  setCookie: () => Promise<void>
+  deleteCookie: () => Promise<void>
 }
 
 /** @public */
@@ -120,10 +123,12 @@ export function getClient (accountsUrl?: string, token?: string): AccountClient
 
 interface Request {
   method: string
-  params: any[]
+  params: Record<string, any>
 }
 
 class AccountClientImpl implements AccountClient {
+  private readonly request: RequestInit
+
   constructor (
     private readonly url: string,
     private readonly token?: string
@@ -131,6 +136,18 @@ class AccountClientImpl implements AccountClient {
     if (url === '') {
       throw new Error('Accounts url not specified')
     }
+
+    this.request = {
+      keepalive: true,
+      headers: {
+        ...(this.token === undefined
+          ? {}
+          : {
+              Authorization: 'Bearer ' + this.token
+            })
+      },
+      credentials: 'include'
+    }
   }
 
   async getProviders (): Promise<string[]> {
@@ -143,16 +160,12 @@ class AccountClientImpl implements AccountClient {
 
   private async rpc<T>(request: Request): Promise<T> {
     const response = await fetch(this.url, {
-      method: 'POST',
-      keepalive: true,
+      ...this.request,
       headers: {
-        ...(this.token === undefined
-          ? {}
-          : {
-              Authorization: 'Bearer ' + this.token
-            }),
+        ...this.request.headers,
         'Content-Type': 'application/json'
       },
+      method: 'POST',
       body: JSON.stringify(request)
     })
 
@@ -183,7 +196,7 @@ class AccountClientImpl implements AccountClient {
   async getUserWorkspaces (): Promise<WorkspaceInfoWithStatus[]> {
     const request = {
       method: 'getUserWorkspaces' as const,
-      params: []
+      params: {}
     }
 
     return (await this.rpc<any[]>(request)).map((ws) => this.flattenStatus(ws))
@@ -196,7 +209,7 @@ class AccountClientImpl implements AccountClient {
   ): Promise<WorkspaceLoginInfo> {
     const request = {
       method: 'selectWorkspace' as const,
-      params: [workspaceUrl, kind, externalRegions]
+      params: { workspaceUrl, kind, externalRegions }
     }
 
     return await this.rpc(request)
@@ -205,7 +218,7 @@ class AccountClientImpl implements AccountClient {
   async validateOtp (email: string, code: string): Promise<LoginInfo> {
     const request = {
       method: 'validateOtp' as const,
-      params: [email, code]
+      params: { email, code }
     }
 
     return await this.rpc(request)
@@ -214,7 +227,7 @@ class AccountClientImpl implements AccountClient {
   async loginOtp (email: string): Promise<OtpInfo> {
     const request = {
       method: 'loginOtp' as const,
-      params: [email]
+      params: { email }
     }
 
     return await this.rpc(request)
@@ -223,7 +236,7 @@ class AccountClientImpl implements AccountClient {
   async getLoginInfoByToken (): Promise<LoginInfo | WorkspaceLoginInfo> {
     const request = {
       method: 'getLoginInfoByToken' as const,
-      params: []
+      params: {}
     }
 
     return await this.rpc(request)
@@ -232,7 +245,7 @@ class AccountClientImpl implements AccountClient {
   async restorePassword (password: string): Promise<LoginInfo> {
     const request = {
       method: 'restorePassword' as const,
-      params: [password]
+      params: { password }
     }
 
     return await this.rpc(request)
@@ -241,7 +254,7 @@ class AccountClientImpl implements AccountClient {
   async confirm (): Promise<LoginInfo> {
     const request = {
       method: 'confirm' as const,
-      params: []
+      params: {}
     }
 
     return await this.rpc(request)
@@ -250,7 +263,7 @@ class AccountClientImpl implements AccountClient {
   async requestPasswordReset (email: string): Promise<void> {
     const request = {
       method: 'requestPasswordReset' as const,
-      params: [email]
+      params: { email }
     }
 
     await this.rpc(request)
@@ -259,7 +272,7 @@ class AccountClientImpl implements AccountClient {
   async sendInvite (email: string, role: AccountRole): Promise<void> {
     const request = {
       method: 'sendInvite' as const,
-      params: [email, role]
+      params: { email, role }
     }
 
     await this.rpc(request)
@@ -277,7 +290,7 @@ class AccountClientImpl implements AccountClient {
   async leaveWorkspace (account: string): Promise<LoginInfo | null> {
     const request = {
       method: 'leaveWorkspace' as const,
-      params: [account]
+      params: { account }
     }
 
     return await this.rpc(request)
@@ -286,7 +299,7 @@ class AccountClientImpl implements AccountClient {
   async changeUsername (first: string, last: string): Promise<void> {
     const request = {
       method: 'changeUsername' as const,
-      params: [first, last]
+      params: { first, last }
     }
 
     await this.rpc(request)
@@ -295,7 +308,7 @@ class AccountClientImpl implements AccountClient {
   async changePassword (oldPassword: string, newPassword: string): Promise<void> {
     const request = {
       method: 'changePassword' as const,
-      params: [oldPassword, newPassword]
+      params: { oldPassword, newPassword }
     }
 
     await this.rpc(request)
@@ -310,7 +323,7 @@ class AccountClientImpl implements AccountClient {
   ): Promise<WorkspaceLoginInfo> {
     const request = {
       method: 'signUpJoin' as const,
-      params: [email, password, first, last, inviteId]
+      params: { email, password, first, last, inviteId }
     }
 
     return await this.rpc(request)
@@ -319,7 +332,7 @@ class AccountClientImpl implements AccountClient {
   async join (email: string, password: string, inviteId: string): Promise<WorkspaceLoginInfo> {
     const request = {
       method: 'join' as const,
-      params: [email, password, inviteId]
+      params: { email, password, inviteId }
     }
 
     return await this.rpc(request)
@@ -334,7 +347,7 @@ class AccountClientImpl implements AccountClient {
   ): Promise<string> {
     const request = {
       method: 'createInviteLink' as const,
-      params: [exp, emailMask, limit, role, personId]
+      params: { exp, emailMask, limit, role, personId }
     }
 
     return await this.rpc(request)
@@ -343,7 +356,7 @@ class AccountClientImpl implements AccountClient {
   async checkJoin (inviteId: string): Promise<WorkspaceLoginInfo> {
     const request = {
       method: 'checkJoin' as const,
-      params: [inviteId]
+      params: { inviteId }
     }
 
     return await this.rpc(request)
@@ -352,7 +365,7 @@ class AccountClientImpl implements AccountClient {
   async getWorkspaceInfo (updateLastVisit: boolean = false): Promise<WorkspaceInfoWithStatus> {
     const request = {
       method: 'getWorkspaceInfo' as const,
-      params: updateLastVisit ? [true] : []
+      params: updateLastVisit ? { updateLastVisit: true } : {}
     }
 
     return this.flattenStatus(await this.rpc(request))
@@ -361,34 +374,34 @@ class AccountClientImpl implements AccountClient {
   async getRegionInfo (): Promise<RegionInfo[]> {
     const request = {
       method: 'getRegionInfo' as const,
-      params: []
+      params: {}
     }
 
     return await this.rpc(request)
   }
 
-  async createWorkspace (name: string, region?: string): Promise<WorkspaceLoginInfo> {
+  async createWorkspace (workspaceName: string, region?: string): Promise<WorkspaceLoginInfo> {
     const request = {
       method: 'createWorkspace' as const,
-      params: [name, region]
+      params: { workspaceName, region }
     }
 
     return await this.rpc(request)
   }
 
-  async signUpOtp (email: string, first: string, last: string): Promise<OtpInfo> {
+  async signUpOtp (email: string, firstName: string, lastName: string): Promise<OtpInfo> {
     const request = {
       method: 'signUpOtp' as const,
-      params: [email, first, last]
+      params: { email, firstName, lastName }
     }
 
     return await this.rpc(request)
   }
 
-  async signUp (email: string, password: string, first: string, last: string): Promise<LoginInfo> {
+  async signUp (email: string, password: string, firstName: string, lastName: string): Promise<LoginInfo> {
     const request = {
       method: 'signUp' as const,
-      params: [email, password, first, last]
+      params: { email, password, firstName, lastName }
     }
 
     return await this.rpc(request)
@@ -397,7 +410,7 @@ class AccountClientImpl implements AccountClient {
   async login (email: string, password: string): Promise<LoginInfo> {
     const request = {
       method: 'login' as const,
-      params: [email, password]
+      params: { email, password }
     }
 
     return await this.rpc(request)
@@ -406,7 +419,7 @@ class AccountClientImpl implements AccountClient {
   async getPerson (): Promise<Person> {
     const request = {
       method: 'getPerson' as const,
-      params: []
+      params: {}
     }
 
     return await this.rpc(request)
@@ -415,7 +428,7 @@ class AccountClientImpl implements AccountClient {
   async getPersonInfo (account: PersonUuid): Promise<PersonInfo> {
     const request = {
       method: 'getPersonInfo' as const,
-      params: [account]
+      params: { account }
     }
 
     return await this.rpc(request)
@@ -424,7 +437,7 @@ class AccountClientImpl implements AccountClient {
   async getSocialIds (): Promise<SocialId[]> {
     const request = {
       method: 'getSocialIds' as const,
-      params: []
+      params: {}
     }
 
     return await this.rpc(request)
@@ -433,7 +446,7 @@ class AccountClientImpl implements AccountClient {
   async workerHandshake (region: string, version: Data<Version>, operation: WorkspaceOperation): Promise<void> {
     const request = {
       method: 'workerHandshake' as const,
-      params: [region, version, operation]
+      params: { region, version, operation }
     }
 
     await this.rpc(request)
@@ -446,7 +459,7 @@ class AccountClientImpl implements AccountClient {
   ): Promise<WorkspaceInfoWithStatus | null> {
     const request = {
       method: 'getPendingWorkspace' as const,
-      params: [region, version, operation]
+      params: { region, version, operation }
     }
 
     const result = await this.rpc(request)
@@ -458,7 +471,7 @@ class AccountClientImpl implements AccountClient {
   }
 
   async updateWorkspaceInfo (
-    wsUuid: string,
+    workspaceUuid: string,
     event: string,
     version: Data<Version>,
     progress: number,
@@ -466,7 +479,7 @@ class AccountClientImpl implements AccountClient {
   ): Promise<void> {
     const request = {
       method: 'updateWorkspaceInfo' as const,
-      params: [wsUuid, event, version, progress, message]
+      params: { workspaceUuid, event, version, progress, message }
     }
 
     await this.rpc(request)
@@ -475,16 +488,16 @@ class AccountClientImpl implements AccountClient {
   async getWorkspaceMembers (): Promise<WorkspaceMemberInfo[]> {
     const request = {
       method: 'getWorkspaceMembers' as const,
-      params: []
+      params: {}
     }
 
     return await this.rpc(request)
   }
 
-  async updateWorkspaceRole (account: string, role: AccountRole): Promise<void> {
+  async updateWorkspaceRole (targetAccount: string, targetRole: AccountRole): Promise<void> {
     const request = {
       method: 'updateWorkspaceRole' as const,
-      params: [account, role]
+      params: { targetAccount, targetRole }
     }
 
     await this.rpc(request)
@@ -493,7 +506,7 @@ class AccountClientImpl implements AccountClient {
   async updateWorkspaceName (name: string): Promise<void> {
     const request = {
       method: 'updateWorkspaceName' as const,
-      params: [name]
+      params: { name }
     }
 
     await this.rpc(request)
@@ -502,7 +515,7 @@ class AccountClientImpl implements AccountClient {
   async deleteWorkspace (): Promise<void> {
     const request = {
       method: 'deleteWorkspace' as const,
-      params: []
+      params: {}
     }
 
     await this.rpc(request)
@@ -511,7 +524,7 @@ class AccountClientImpl implements AccountClient {
   async findPerson (socialString: string): Promise<PersonUuid | undefined> {
     const request = {
       method: 'findPerson' as const,
-      params: [socialString]
+      params: { socialString }
     }
 
     return await this.rpc(request)
@@ -520,7 +533,7 @@ class AccountClientImpl implements AccountClient {
   async listWorkspaces (region?: string | null, mode: WorkspaceMode | null = null): Promise<WorkspaceInfoWithStatus[]> {
     const request = {
       method: 'listWorkspaces' as const,
-      params: [region, mode]
+      params: { region, mode }
     }
 
     return ((await this.rpc<any[]>(request)) ?? []).map((ws) => this.flattenStatus(ws))
@@ -533,16 +546,16 @@ class AccountClientImpl implements AccountClient {
   ): Promise<boolean> {
     const request = {
       method: 'performWorkspaceOperation' as const,
-      params: [workspaceId, event, ...params]
+      params: { workspaceId, event, params }
     }
 
     return await this.rpc(request)
   }
 
-  async updateBackupInfo (info: BackupStatus): Promise<void> {
+  async updateBackupInfo (backupInfo: BackupStatus): Promise<void> {
     const request = {
       method: 'updateBackupInfo' as const,
-      params: [info]
+      params: { backupInfo }
     }
 
     await this.rpc(request)
@@ -551,7 +564,7 @@ class AccountClientImpl implements AccountClient {
   async assignWorkspace (email: string, workspaceUuid: string, role: AccountRole): Promise<void> {
     const request = {
       method: 'assignWorkspace' as const,
-      params: [email, workspaceUuid, role]
+      params: { email, workspaceUuid, role }
     }
 
     await this.rpc(request)
@@ -560,11 +573,35 @@ class AccountClientImpl implements AccountClient {
   async updateWorkspaceRoleBySocialId (socialKey: string, targetRole: AccountRole): Promise<void> {
     const request = {
       method: 'updateWorkspaceRoleBySocialId' as const,
-      params: [socialKey, targetRole]
+      params: { socialKey, targetRole }
     }
 
     await this.rpc(request)
   }
+
+  async setCookie (): Promise<void> {
+    const url = concatLink(this.url, '/cookie')
+    const response = await fetch(url, { ...this.request, method: 'PUT' })
+
+    if (!response.ok) {
+      const result = await response.json()
+      if (result.error != null) {
+        throw new PlatformError(result.error)
+      }
+    }
+  }
+
+  async deleteCookie (): Promise<void> {
+    const url = concatLink(this.url, '/cookie')
+    const response = await fetch(url, { ...this.request, method: 'DELETE' })
+
+    if (!response.ok) {
+      const result = await response.json()
+      if (result.error != null) {
+        throw new PlatformError(result.error)
+      }
+    }
+  }
 }
 
 async function retry<T> (retries: number, op: () => Promise<T>, delay: number = 100): Promise<T> {
diff --git a/plugins/guest-resources/src/connect.ts b/plugins/guest-resources/src/connect.ts
index a6a099f126c..ffad8416a5e 100644
--- a/plugins/guest-resources/src/connect.ts
+++ b/plugins/guest-resources/src/connect.ts
@@ -15,20 +15,14 @@ import { setCurrentEmployee, type Employee } from '@hcengineering/contact'
 import login, { loginId } from '@hcengineering/login'
 import { getMetadata, getResource, setMetadata } from '@hcengineering/platform'
 import presentation, {
-  closeClient,
   loadServerConfig,
   refreshClient,
   setClient,
   setPresentationCookie,
   upgradeDownloadProgress
 } from '@hcengineering/presentation'
-import {
-  desktopPlatform,
-  fetchMetadataLocalStorage,
-  getCurrentLocation,
-  navigate,
-  setMetadataLocalStorage
-} from '@hcengineering/ui'
+import { desktopPlatform, getCurrentLocation, navigate } from '@hcengineering/ui'
+import { logOut } from '@hcengineering/workbench'
 import { writable, get } from 'svelte/store'
 
 export const versionError = writable<string | undefined>(undefined)
@@ -48,7 +42,6 @@ export async function connect (title: string): Promise<Client | undefined> {
     })
     return
   }
-  setMetadata(presentation.metadata.Token, token)
 
   const selectWorkspace = await getResource(login.function.SelectWorkspace)
   const workspaceLoginInfo = (await selectWorkspace(wsUrl, token))[1]
@@ -57,10 +50,8 @@ export async function connect (title: string): Promise<Client | undefined> {
       `Error selecting workspace ${wsUrl}. There might be something wrong with the token. Please try to log in again.`
     )
     // something went wrong with selecting workspace with the selected token
-    clearMetadata(wsUrl)
-    navigate({
-      path: [loginId]
-    })
+    await logOut()
+    navigate({ path: [loginId] })
     return
   }
 
@@ -126,10 +117,11 @@ export async function connect (title: string): Promise<Client | undefined> {
       location.reload()
     },
     onUnauthorized: () => {
-      clearMetadata(wsUrl)
-      navigate({
-        path: [loginId],
-        query: {}
+      void logOut().then(() => {
+        navigate({
+          path: [loginId],
+          query: {}
+        })
       })
     },
     // We need to refresh all active live queries and clear old queries.
@@ -240,22 +232,3 @@ export async function connect (title: string): Promise<Client | undefined> {
 
   return _client
 }
-
-function clearMetadata (ws: string): void {
-  const tokens = fetchMetadataLocalStorage(login.metadata.LoginTokensV2)
-  if (tokens !== null) {
-    const loc = getCurrentLocation()
-    // eslint-disable-next-line
-    delete tokens[loc.path[1]]
-    setMetadataLocalStorage(login.metadata.LoginTokensV2, tokens)
-  }
-  const currentWorkspace = getMetadata(presentation.metadata.WorkspaceUuid)
-  if (currentWorkspace !== undefined) {
-    setPresentationCookie('', currentWorkspace)
-  }
-
-  setMetadata(presentation.metadata.Token, null)
-  setMetadataLocalStorage(login.metadata.LastToken, null)
-  setMetadataLocalStorage(login.metadata.LoginAccount, null)
-  void closeClient()
-}
diff --git a/plugins/guest-resources/src/utils.ts b/plugins/guest-resources/src/utils.ts
index 7c98303d1ce..30e15b4653b 100644
--- a/plugins/guest-resources/src/utils.ts
+++ b/plugins/guest-resources/src/utils.ts
@@ -1,9 +1,9 @@
 import client from '@hcengineering/client'
-import { type Doc } from '@hcengineering/core'
+import { type Doc, AccountRole } from '@hcengineering/core'
 import login from '@hcengineering/login'
-import { getMetadata, getResource, setMetadata } from '@hcengineering/platform'
+import { getMetadata, getResource } from '@hcengineering/platform'
 import presentation from '@hcengineering/presentation'
-import { fetchMetadataLocalStorage, getCurrentLocation, navigate } from '@hcengineering/ui'
+import { getCurrentLocation, navigate } from '@hcengineering/ui'
 import view from '@hcengineering/view'
 import { getObjectLinkFragment } from '@hcengineering/view-resources'
 import { workbenchId } from '@hcengineering/workbench'
@@ -11,10 +11,15 @@ import { workbenchId } from '@hcengineering/workbench'
 export async function checkAccess (doc: Doc): Promise<void> {
   const loc = getCurrentLocation()
   const ws = loc.path[1]
-  const tokens: Record<string, string> = fetchMetadataLocalStorage(login.metadata.LoginTokensV2) ?? {}
-  const token = tokens[ws]
+
+  const selectWorkspace = await getResource(login.function.SelectWorkspace)
+  const wsLoginInfo = (await selectWorkspace(ws, null))[1]
+  if (wsLoginInfo === undefined || wsLoginInfo.role === AccountRole.DocGuest) return
+
+  const token = wsLoginInfo.token
   const endpoint = getMetadata(presentation.metadata.Endpoint)
   if (token === undefined || endpoint === undefined) return
+
   const clientFactory = await getResource(client.function.GetClient)
   const _client = await clientFactory(token, endpoint)
 
@@ -28,7 +33,7 @@ export async function checkAccess (doc: Doc): Promise<void> {
     loc.path[0] = workbenchId
     loc.path[1] = ws
     // We have access, let's set correct tokens and redirect)
-    setMetadata(presentation.metadata.Token, token)
+    // setMetadata(presentation.metadata.Token, token)
     navigate(loc)
   }
 }
diff --git a/plugins/login-resources/src/actions.ts b/plugins/login-resources/src/actions.ts
index 7dbb32e473c..36905f800e3 100644
--- a/plugins/login-resources/src/actions.ts
+++ b/plugins/login-resources/src/actions.ts
@@ -1,7 +1,6 @@
 import { goTo } from './utils'
 import login from './plugin'
 import { type BottomAction } from '.'
-import { setMetadataLocalStorage } from '@hcengineering/ui'
 import { setMetadata } from '@hcengineering/platform'
 import presentation from '@hcengineering/presentation'
 
@@ -20,7 +19,6 @@ export const loginAction: BottomAction = {
   page: 'login',
   func: () => {
     setMetadata(presentation.metadata.Token, null)
-    setMetadataLocalStorage(login.metadata.LastToken, null)
     goTo('login', true)
   }
 }
diff --git a/plugins/login-resources/src/components/Auth.svelte b/plugins/login-resources/src/components/Auth.svelte
index d191e14bf27..25d589a0043 100644
--- a/plugins/login-resources/src/components/Auth.svelte
+++ b/plugins/login-resources/src/components/Auth.svelte
@@ -1,24 +1,21 @@
 <script lang="ts">
-  import { setMetadata } from '@hcengineering/platform'
-  import presentation from '@hcengineering/presentation'
-  import { Loading, setMetadataLocalStorage } from '@hcengineering/ui'
+  import { Loading } from '@hcengineering/ui'
+  import { logIn } from '@hcengineering/workbench'
   import { onMount } from 'svelte'
 
-  import login from '../plugin'
   import { afterConfirm, getLoginInfoFromQuery, goTo, isWorkspaceLoginInfo, navigateToWorkspace } from '../utils'
 
   onMount(async () => {
     const result = await getLoginInfoFromQuery()
 
     if (result != null) {
+      await logIn(result)
+
       if (isWorkspaceLoginInfo(result)) {
         navigateToWorkspace(result.workspaceUrl, result, undefined, true)
         return
       }
 
-      setMetadata(presentation.metadata.Token, result.token)
-      setMetadataLocalStorage(login.metadata.LastToken, result.token)
-      setMetadataLocalStorage(login.metadata.LoginAccount, result.account)
       await afterConfirm(true)
     } else {
       goTo('login', true)
diff --git a/plugins/login-resources/src/components/Confirmation.svelte b/plugins/login-resources/src/components/Confirmation.svelte
index 86766b33994..84db6387a87 100644
--- a/plugins/login-resources/src/components/Confirmation.svelte
+++ b/plugins/login-resources/src/components/Confirmation.svelte
@@ -14,9 +14,9 @@
 -->
 <script lang="ts">
   import { onMount } from 'svelte'
-  import presentation from '@hcengineering/presentation'
-  import { OK, Severity, Status, setMetadata } from '@hcengineering/platform'
-  import { getCurrentLocation, setMetadataLocalStorage } from '@hcengineering/ui'
+  import { OK, Severity, Status } from '@hcengineering/platform'
+  import { getCurrentLocation } from '@hcengineering/ui'
+  import { logIn } from '@hcengineering/workbench'
 
   import login from '../plugin'
   import { afterConfirm, confirm, goTo } from '../utils'
@@ -33,10 +33,7 @@
     status = loginStatus
 
     if (result !== undefined) {
-      setMetadata(presentation.metadata.Token, result.token)
-      setMetadataLocalStorage(login.metadata.LastToken, result.token)
-      setMetadataLocalStorage(login.metadata.LoginEndpoint, result.endpoint)
-      setMetadataLocalStorage(login.metadata.LoginEmail, result.email)
+      await logIn(result)
       await afterConfirm()
     } else {
       goTo('login')
diff --git a/plugins/login-resources/src/components/CreateWorkspaceForm.svelte b/plugins/login-resources/src/components/CreateWorkspaceForm.svelte
index ff445952b33..c7d3a74a9e5 100644
--- a/plugins/login-resources/src/components/CreateWorkspaceForm.svelte
+++ b/plugins/login-resources/src/components/CreateWorkspaceForm.svelte
@@ -14,21 +14,14 @@
 // limitations under the License.
 -->
 <script lang="ts">
+  import { type RegionInfo } from '@hcengineering/account-client'
   import { OK, Severity, Status, getEmbeddedLabel } from '@hcengineering/platform'
   import { LoginInfo } from '@hcengineering/login'
   import { ButtonMenu, getCurrentLocation, navigate } from '@hcengineering/ui'
   import { workbenchId } from '@hcengineering/workbench'
   import { onMount } from 'svelte'
   import login from '../plugin'
-  import {
-    createWorkspace,
-    getAccount,
-    getRegionInfo,
-    goTo,
-    setLoginInfo,
-    getAccountDisplayName,
-    type RegionInfo
-  } from '../utils'
+  import { createWorkspace, getAccount, getRegionInfo, goTo, setLoginInfo, getAccountDisplayName } from '../utils'
   import Form from './Form.svelte'
 
   const fields = [
diff --git a/plugins/login-resources/src/components/Join.svelte b/plugins/login-resources/src/components/Join.svelte
index 92d8d217a8c..73b11ea8370 100644
--- a/plugins/login-resources/src/components/Join.svelte
+++ b/plugins/login-resources/src/components/Join.svelte
@@ -20,7 +20,7 @@
   import Form from './Form.svelte'
 
   import { Analytics } from '@hcengineering/analytics'
-  import { workbenchId } from '@hcengineering/workbench'
+  import { logIn, workbenchId } from '@hcengineering/workbench'
   import { onMount } from 'svelte'
   import { BottomAction } from '..'
   import { loginAction, recoveryAction } from '../actions'
@@ -77,6 +77,7 @@
       status = loginStatus
 
       if (result != null) {
+        await logIn(result)
         setLoginInfo(result)
 
         if (location.query?.navigateUrl != null) {
diff --git a/plugins/login-resources/src/components/LoginApp.svelte b/plugins/login-resources/src/components/LoginApp.svelte
index fee0cc9f1c5..71a8e8cedd2 100644
--- a/plugins/login-resources/src/components/LoginApp.svelte
+++ b/plugins/login-resources/src/components/LoginApp.svelte
@@ -72,8 +72,8 @@
       'auth'
     ]
     if (token === undefined ? !allowedUnauthPages.includes(page) : !pages.includes(page)) {
-      const tokens = fetchMetadataLocalStorage(login.metadata.LoginTokensV2)
-      page = tokens != null ? 'login' : 'signup'
+      const account = fetchMetadataLocalStorage(login.metadata.LastAccount)
+      page = account != null ? 'login' : 'signup'
     }
 
     navigateUrl = loc.query?.navigateUrl ?? undefined
@@ -86,18 +86,17 @@
     }
 
     if (getMetadata(presentation.metadata.Token) == null) {
-      const lastToken = fetchMetadataLocalStorage(login.metadata.LastToken)
-      if (lastToken != null) {
+      const lastAccount = fetchMetadataLocalStorage(login.metadata.LastAccount)
+      if (lastAccount != null) {
         try {
           const loginInfo = await getAccount(false)
           if (loginInfo != null) {
             setMetadata(presentation.metadata.Token, loginInfo.token)
-            setMetadataLocalStorage(login.metadata.LastToken, loginInfo.token)
             setMetadataLocalStorage(login.metadata.LoginAccount, loginInfo.account)
             updatePageLoc(getCurrentLocation())
           }
         } catch (err: any) {
-          setMetadataLocalStorage(login.metadata.LastToken, null)
+          // do nothing
         }
       }
     }
diff --git a/plugins/login-resources/src/components/PasswordRestore.svelte b/plugins/login-resources/src/components/PasswordRestore.svelte
index 16a3615ee0d..2871217b201 100644
--- a/plugins/login-resources/src/components/PasswordRestore.svelte
+++ b/plugins/login-resources/src/components/PasswordRestore.svelte
@@ -13,10 +13,10 @@
 // limitations under the License.
 -->
 <script lang="ts">
-  import { OK, setMetadata, Severity, Status } from '@hcengineering/platform'
+  import { OK, Severity, Status } from '@hcengineering/platform'
 
-  import presentation from '@hcengineering/presentation'
-  import { getCurrentLocation, setMetadataLocalStorage } from '@hcengineering/ui'
+  import { getCurrentLocation } from '@hcengineering/ui'
+  import { logIn } from '@hcengineering/workbench'
   import login from '../plugin'
   import type { Field } from '../types'
   import { goTo, restorePassword } from '../utils'
@@ -53,8 +53,7 @@
       status = loginStatus
 
       if (result != null) {
-        setMetadata(presentation.metadata.Token, result.token)
-        setMetadataLocalStorage(login.metadata.LoginAccount, result.account)
+        await logIn(result)
         goTo('selectWorkspace')
       }
     }
diff --git a/plugins/login-resources/src/components/SelectWorkspace.svelte b/plugins/login-resources/src/components/SelectWorkspace.svelte
index 60c6ed421e3..6e5e7a7c984 100644
--- a/plugins/login-resources/src/components/SelectWorkspace.svelte
+++ b/plugins/login-resources/src/components/SelectWorkspace.svelte
@@ -17,8 +17,7 @@
   import { WorkspaceInfoWithStatus, isArchivingMode } from '@hcengineering/core'
   import { LoginInfo } from '@hcengineering/login'
   import { OK, Severity, Status } from '@hcengineering/platform'
-  import presentation, { NavLink, isAdminUser, reduceCalls } from '@hcengineering/presentation'
-  import MessageBox from '@hcengineering/presentation/src/components/MessageBox.svelte'
+  import presentation, { MessageBox, NavLink, isAdminUser, reduceCalls } from '@hcengineering/presentation'
   import {
     ticker,
     Button,
@@ -27,9 +26,9 @@
     SearchEdit,
     Spinner,
     deviceOptionsStore as deviceInfo,
-    setMetadataLocalStorage,
     showPopup
   } from '@hcengineering/ui'
+  import { logOut } from '@hcengineering/workbench'
   import { onMount } from 'svelte'
 
   import login from '../plugin'
@@ -113,10 +112,7 @@
       await updateWorkspaces()
       flagToUpdateWorkspaces = true
     } catch (err: any) {
-      setMetadataLocalStorage(login.metadata.LastToken, null)
-      setMetadataLocalStorage(presentation.metadata.Token, null)
-      setMetadataLocalStorage(login.metadata.LoginEndpoint, null)
-      setMetadataLocalStorage(login.metadata.LoginAccount, null)
+      await logOut()
       goTo('login')
       throw err
     }
@@ -233,11 +229,8 @@
         <span><Label label={login.string.NotSeeingWorkspace} /></span>
         <NavLink
           href={getHref('login')}
-          onClick={() => {
-            setMetadataLocalStorage(login.metadata.LastToken, null)
-            setMetadataLocalStorage(presentation.metadata.Token, null)
-            setMetadataLocalStorage(login.metadata.LoginEndpoint, null)
-            setMetadataLocalStorage(login.metadata.LoginAccount, null)
+          onClick={async () => {
+            await logOut()
             goTo('login')
           }}
         >
diff --git a/plugins/login-resources/src/components/SignupForm.svelte b/plugins/login-resources/src/components/SignupForm.svelte
index 54538a0d1c6..3adaf2e7dcd 100644
--- a/plugins/login-resources/src/components/SignupForm.svelte
+++ b/plugins/login-resources/src/components/SignupForm.svelte
@@ -14,9 +14,9 @@
 // limitations under the License.
 -->
 <script lang="ts">
-  import { OK, Severity, Status, setMetadata } from '@hcengineering/platform'
+  import { OK, Severity, Status } from '@hcengineering/platform'
   import presentation from '@hcengineering/presentation'
-  import { setMetadataLocalStorage } from '@hcengineering/ui'
+  import { logIn } from '@hcengineering/workbench'
   import BottomActionComponent from './BottomAction.svelte'
   import login from '../plugin'
   import { getPasswordValidationRules } from '../validations'
@@ -79,8 +79,7 @@
         status = loginStatus
 
         if (result != null) {
-          setMetadata(presentation.metadata.Token, result.token)
-          setMetadataLocalStorage(login.metadata.LastToken, result.token)
+          await logIn(result)
           goTo('confirmationSend')
         }
       } else {
diff --git a/plugins/login-resources/src/utils.ts b/plugins/login-resources/src/utils.ts
index 3b5aa15e8c3..f312e6d46b7 100644
--- a/plugins/login-resources/src/utils.ts
+++ b/plugins/login-resources/src/utils.ts
@@ -40,7 +40,6 @@ import platform, {
 } from '@hcengineering/platform'
 import presentation from '@hcengineering/presentation'
 import {
-  fetchMetadataLocalStorage,
   getCurrentLocation,
   locationStorageKeyId,
   locationToUrl,
@@ -48,7 +47,7 @@ import {
   setMetadataLocalStorage,
   type Location
 } from '@hcengineering/ui'
-import { workbenchId } from '@hcengineering/workbench'
+import { workbenchId, logIn } from '@hcengineering/workbench'
 
 import { LoginEvents } from './analytics'
 import { type Pages } from './index'
@@ -70,7 +69,9 @@ function getAccountClient (token: string | undefined | null = getMetadata(presen
  */
 export async function doLogin (email: string, password: string): Promise<[Status, LoginInfo | null]> {
   try {
-    const loginInfo = await getAccountClient(null).login(email, password)
+    const accountClient = getAccountClient(null)
+
+    const loginInfo = await accountClient.login(email, password)
 
     Analytics.handleEvent(LoginEvents.LoginPassword, { email, ok: true })
     Analytics.setUser(email)
@@ -188,7 +189,7 @@ function getWorkspaceSize (it: Pick<WorkspaceInfoWithStatus, 'backupInfo'>): num
 
 export async function getWorkspaces (): Promise<WorkspaceInfoWithStatus[]> {
   const token = getMetadata(presentation.metadata.Token)
-  if (token === undefined) {
+  if (token == null) {
     const loc = getCurrentLocation()
     loc.path[1] = 'login'
     loc.path.length = 2
@@ -280,7 +281,7 @@ export async function getAllWorkspaces (): Promise<WorkspaceInfoWithStatus[]> {
 }
 
 export async function getAccount (doNavigate: boolean = true): Promise<LoginInfo | null> {
-  const token = getMetadata(presentation.metadata.Token) ?? fetchMetadataLocalStorage(login.metadata.LastToken)
+  const token = getMetadata(presentation.metadata.Token)
   if (token == null) {
     if (doNavigate) {
       const loc = getCurrentLocation()
@@ -288,8 +289,6 @@ export async function getAccount (doNavigate: boolean = true): Promise<LoginInfo
       loc.path.length = 2
       navigate(loc)
     }
-
-    return null
   }
 
   try {
@@ -308,7 +307,7 @@ export async function getAccount (doNavigate: boolean = true): Promise<LoginInfo
 }
 
 export async function getRegionInfo (doNavigate: boolean = true): Promise<RegionInfo[] | null> {
-  const token = getMetadata(presentation.metadata.Token) ?? fetchMetadataLocalStorage(login.metadata.LastToken)
+  const token = getMetadata(presentation.metadata.Token)
   if (token == null) {
     if (doNavigate) {
       const loc = getCurrentLocation()
@@ -338,27 +337,21 @@ export async function selectWorkspace (
   workspaceUrl: string,
   token?: string | null | undefined
 ): Promise<[Status, WorkspaceLoginInfo | null]> {
-  const actualToken =
-    token ??
-    getMetadata(presentation.metadata.Token) ??
-    fetchMetadataLocalStorage(login.metadata.LastToken) ??
-    undefined
-
-  if (actualToken == null) {
-    const loc = getCurrentLocation()
-    loc.path[0] = 'login'
-    loc.path[1] = 'login'
-    loc.path.length = 2
-    navigate(loc)
-    return [unknownStatus('Please login'), null]
-  }
+  const actualToken = token ?? getMetadata(presentation.metadata.Token) ?? undefined
 
   try {
     const loginInfo = await getAccountClient(actualToken).selectWorkspace(workspaceUrl)
 
     return [OK, loginInfo]
   } catch (err: any) {
-    if (err instanceof PlatformError) {
+    if (err instanceof PlatformError && err.status.code === platform.status.Unauthorized) {
+      const loc = getCurrentLocation()
+      loc.path[0] = 'login'
+      loc.path[1] = 'login'
+      loc.path.length = 2
+      navigate(loc)
+      return [unknownStatus('Please login'), null]
+    } else if (err instanceof PlatformError) {
       Analytics.handleEvent(LoginEvents.SelectWorkspace, { name: workspaceUrl, ok: false })
       await handleStatusError('Select workspace error', err.status)
 
@@ -421,14 +414,12 @@ export async function getPerson (): Promise<[Status, Person | null]> {
 }
 
 export function setLoginInfo (loginInfo: WorkspaceLoginInfo): void {
-  const tokens: Record<string, string> = fetchMetadataLocalStorage(login.metadata.LoginTokensV2) ?? {}
-  tokens[loginInfo.workspaceUrl] = loginInfo.token
-
   setMetadata(presentation.metadata.Token, loginInfo.token)
-  setMetadataLocalStorage(login.metadata.LastToken, loginInfo.token)
-  setMetadataLocalStorage(login.metadata.LoginTokensV2, tokens)
+  setMetadata(presentation.metadata.WorkspaceUuid, loginInfo.workspace)
+  setMetadata(presentation.metadata.WorkspaceDataId, loginInfo.workspaceDataId)
   setMetadataLocalStorage(login.metadata.LoginEndpoint, loginInfo.endpoint)
   setMetadataLocalStorage(login.metadata.LoginAccount, loginInfo.account)
+  setMetadataLocalStorage(login.metadata.LastAccount, loginInfo.account)
 }
 
 export function navigateToWorkspace (
@@ -441,9 +432,6 @@ export function navigateToWorkspace (
     return
   }
 
-  setMetadata(presentation.metadata.Token, loginInfo.token)
-  setMetadata(presentation.metadata.WorkspaceUuid, loginInfo.workspace)
-  setMetadata(presentation.metadata.WorkspaceDataId, loginInfo.workspaceDataId)
   setLoginInfo(loginInfo)
 
   if (navigateUrl !== undefined) {
@@ -466,12 +454,11 @@ export function navigateToWorkspace (
 }
 
 export async function checkJoined (inviteId: string): Promise<[Status, WorkspaceLoginInfo | null]> {
-  let token = getMetadata(presentation.metadata.Token)
+  const token = getMetadata(presentation.metadata.Token)
 
   if (token == null) {
-    const tokens: Record<string, string> = fetchMetadataLocalStorage(login.metadata.LoginTokensV2) ?? {}
-    token = Object.values(tokens)[0]
-    if (token == null) {
+    const loginInfo = await getAccountClient().getLoginInfoByToken()
+    if (loginInfo.token == null) {
       return [unknownStatus('Please login'), null]
     }
   }
@@ -549,7 +536,7 @@ export async function join (
   inviteId: string
 ): Promise<[Status, WorkspaceLoginInfo | null]> {
   try {
-    const workspaceLoginInfo = await getAccountClient(null).join(email, password, inviteId)
+    const workspaceLoginInfo = await getAccountClient().join(email, password, inviteId)
 
     Analytics.handleEvent('Join')
     Analytics.setUser(email)
@@ -576,7 +563,7 @@ export async function signUpJoin (
   inviteId: string
 ): Promise<[Status, WorkspaceLoginInfo | null]> {
   try {
-    const workspaceLoginInfo = await getAccountClient(null).signUpJoin(email, password, first, last, inviteId)
+    const workspaceLoginInfo = await getAccountClient().signUpJoin(email, password, first, last, inviteId)
 
     Analytics.handleEvent('Signup Join')
     Analytics.setUser(email)
@@ -741,13 +728,12 @@ export async function afterConfirm (clearQuery = false): Promise<void> {
   if (joinedWS.length === 0) {
     goTo('createWorkspace', clearQuery)
   } else if (joinedWS.length === 1) {
-    const result = (await selectWorkspace(joinedWS[0].uuid, null))[1]
+    const result = (await selectWorkspace(joinedWS[0].url, null))[1]
     if (result != null) {
       setMetadata(presentation.metadata.Token, result.token)
       setMetadata(presentation.metadata.WorkspaceUuid, result.workspace)
       setMetadata(presentation.metadata.WorkspaceDataId, result.workspaceDataId)
 
-      setMetadataLocalStorage(login.metadata.LastToken, result.token)
       setLoginInfo(result)
 
       navigateToWorkspace(joinedWS[0].uuid, result, undefined, clearQuery)
@@ -757,6 +743,22 @@ export async function afterConfirm (clearQuery = false): Promise<void> {
   }
 }
 
+export async function getLoginInfo (): Promise<LoginInfo | WorkspaceLoginInfo | null> {
+  try {
+    return await getAccountClient().getLoginInfoByToken()
+  } catch (err: any) {
+    if (err instanceof PlatformError) {
+      if (err.status.code === platform.status.Unauthorized) {
+        return null
+      }
+    } else {
+      Analytics.handleError(err)
+    }
+
+    throw err
+  }
+}
+
 export async function getLoginInfoFromQuery (): Promise<LoginInfo | WorkspaceLoginInfo | null> {
   const token = getCurrentLocation().query?.token
 
@@ -838,9 +840,7 @@ export async function doLoginNavigate (
   navigateUrl?: string
 ): Promise<void> {
   if (result != null) {
-    setMetadata(presentation.metadata.Token, result.token)
-    setMetadataLocalStorage(login.metadata.LastToken, result.token)
-    setMetadataLocalStorage(login.metadata.LoginAccount, result.account)
+    await logIn(result)
 
     if (navigateUrl !== undefined) {
       try {
diff --git a/plugins/login/src/index.ts b/plugins/login/src/index.ts
index c5d1188a2cb..d2b40534e6c 100644
--- a/plugins/login/src/index.ts
+++ b/plugins/login/src/index.ts
@@ -29,8 +29,7 @@ export const loginId = 'login' as Plugin
 export default plugin(loginId, {
   metadata: {
     AccountsUrl: '' as Asset,
-    LoginTokensV2: '' as Metadata<Record<string, string>>,
-    LastToken: '' as Metadata<string>,
+    LastAccount: '' as Metadata<string>,
     LoginEndpoint: '' as Metadata<string>,
     LoginAccount: '' as Metadata<string>,
     DisableSignUp: '' as Metadata<boolean>,
diff --git a/plugins/onboard-resources/src/components/Auth.svelte b/plugins/onboard-resources/src/components/Auth.svelte
index 7d47d5bff7b..48e1de9074a 100644
--- a/plugins/onboard-resources/src/components/Auth.svelte
+++ b/plugins/onboard-resources/src/components/Auth.svelte
@@ -1,23 +1,20 @@
 <script lang="ts">
-  import login, { LoginInfo, WorkspaceLoginInfo } from '@hcengineering/login'
+  import { LoginInfo, WorkspaceLoginInfo } from '@hcengineering/login'
   import { getLoginInfoFromQuery, navigateToWorkspace } from '@hcengineering/login-resources'
-  import { setMetadata } from '@hcengineering/platform'
-  import presentation from '@hcengineering/presentation'
-  import { Loading, setMetadataLocalStorage } from '@hcengineering/ui'
+  import { Loading } from '@hcengineering/ui'
+  import { logIn } from '@hcengineering/workbench'
   import { onMount } from 'svelte'
   import { afterConfirm, goToLogin } from '../utils'
 
   onMount(async () => {
     const result = await getLoginInfoFromQuery()
-    if (result !== undefined) {
+    if (result != null) {
+      await logIn(result)
+
       if (isWorkspaceLoginInfo(result)) {
         navigateToWorkspace(result.workspace, result, undefined, true)
         return
       }
-      setMetadata(presentation.metadata.Token, result.token)
-      setMetadataLocalStorage(login.metadata.LastToken, result.token)
-      setMetadataLocalStorage(login.metadata.LoginEndpoint, result.endpoint)
-      setMetadataLocalStorage(login.metadata.LoginEmail, result.email)
       await afterConfirm(true)
     } else {
       goToLogin('login', true)
diff --git a/plugins/onboard-resources/src/components/OnboardApp.svelte b/plugins/onboard-resources/src/components/OnboardApp.svelte
index 17e33e29c46..cf569804a84 100644
--- a/plugins/onboard-resources/src/components/OnboardApp.svelte
+++ b/plugins/onboard-resources/src/components/OnboardApp.svelte
@@ -64,20 +64,20 @@
       // token handled by auth page
       return
     }
+
     if (getMetadata(presentation.metadata.Token) == null) {
-      const lastToken = fetchMetadataLocalStorage(login.metadata.LastToken)
-      if (lastToken != null) {
+      const lastAccount = fetchMetadataLocalStorage(login.metadata.LastAccount)
+      if (lastAccount != null) {
         try {
           const info = await getAccount(false)
-          if (info !== undefined) {
+          if (info != null) {
             setMetadata(presentation.metadata.Token, info.token)
-            setMetadataLocalStorage(login.metadata.LastToken, info.token)
-            setMetadataLocalStorage(login.metadata.LoginEndpoint, info.endpoint)
-            setMetadataLocalStorage(login.metadata.LoginEmail, info.email)
+            setMetadataLocalStorage(login.metadata.LastAccount, info.account)
+            setMetadataLocalStorage(login.metadata.LoginAccount, info.account)
             updatePageLoc(getCurrentLocation())
           }
         } catch (err: any) {
-          setMetadataLocalStorage(login.metadata.LastToken, null)
+          // do nothing
         }
       }
     }
diff --git a/plugins/setting-resources/src/components/Profile.svelte b/plugins/setting-resources/src/components/Profile.svelte
index 397b2678707..a1c8355ac4e 100644
--- a/plugins/setting-resources/src/components/Profile.svelte
+++ b/plugins/setting-resources/src/components/Profile.svelte
@@ -17,8 +17,8 @@
   import { ChannelsEditor, EditableAvatar, personByIdStore, mySocialIdsStore } from '@hcengineering/contact-resources'
   import { getCurrentAccount, SocialIdType } from '@hcengineering/core'
   import login, { loginId } from '@hcengineering/login'
-  import { getResource, setMetadata } from '@hcengineering/platform'
-  import presentation, { AttributeEditor, MessageBox, getClient } from '@hcengineering/presentation'
+  import { getResource } from '@hcengineering/platform'
+  import { AttributeEditor, MessageBox, getClient } from '@hcengineering/presentation'
   import {
     Breadcrumb,
     Button,
@@ -27,11 +27,9 @@
     Header,
     createFocusManager,
     showPopup,
-    navigate,
-    setMetadataLocalStorage,
-    getCurrentLocation
+    navigate
   } from '@hcengineering/ui'
-  import { clearMetadata } from '@hcengineering/workbench-resources'
+  import { logIn, logOut } from '@hcengineering/workbench-resources'
 
   import setting from '../plugin'
 
@@ -64,16 +62,11 @@
         const leaveWorkspace = await getResource(login.function.LeaveWorkspace)
         const loginInfo = await leaveWorkspace(getCurrentAccount().uuid)
 
-        const loc = getCurrentLocation()
-        clearMetadata(loc.path[1])
-
         if (loginInfo?.token != null) {
-          setMetadata(presentation.metadata.Token, loginInfo.token)
-          setMetadataLocalStorage(login.metadata.LastToken, loginInfo.token)
-          setMetadataLocalStorage(login.metadata.LoginAccount, loginInfo.account)
-
+          await logIn(loginInfo)
           navigate({ path: [loginId, 'selectWorkspace'] })
         } else {
+          await logOut()
           navigate({ path: [loginId, 'login'] })
         }
       }
diff --git a/plugins/setting-resources/src/components/Settings.svelte b/plugins/setting-resources/src/components/Settings.svelte
index 94e6b2c3481..c7d090b20ba 100644
--- a/plugins/setting-resources/src/components/Settings.svelte
+++ b/plugins/setting-resources/src/components/Settings.svelte
@@ -15,8 +15,7 @@
 <script lang="ts">
   import { AccountRole, getCurrentAccount, hasAccountRole } from '@hcengineering/core'
   import login, { loginId } from '@hcengineering/login'
-  import { setMetadata } from '@hcengineering/platform'
-  import presentation, { closeClient, getClient, createQuery } from '@hcengineering/presentation'
+  import { getClient, createQuery } from '@hcengineering/presentation'
   import settingPlg from '../plugin'
   import setting, { SettingsCategory, SettingsEvents } from '@hcengineering/setting'
   import {
@@ -27,18 +26,23 @@
     Scroller,
     Separator,
     defineSeparators,
-    fetchMetadataLocalStorage,
     getCurrentResolvedLocation,
     navigate,
     resolvedLocationStore,
-    setMetadataLocalStorage,
     settingsSeparators,
     showPopup,
     type AnyComponent,
     deviceOptionsStore as deviceInfo,
     deviceWidths
   } from '@hcengineering/ui'
-  import { closeWidget, NavFooter, openWidget, minimizeSidebar, sidebarStore } from '@hcengineering/workbench-resources'
+  import {
+    closeWidget,
+    NavFooter,
+    openWidget,
+    minimizeSidebar,
+    sidebarStore,
+    logOut
+  } from '@hcengineering/workbench-resources'
   import workbench from '@hcengineering/workbench'
   import { ComponentType, onDestroy, onMount } from 'svelte'
   import { clearSettingsStore, settingsStore, type SettingsStore } from '../store'
@@ -99,20 +103,8 @@
     navigate(loc)
   }
   function signOut (): void {
-    const tokens = fetchMetadataLocalStorage(login.metadata.LoginTokensV2)
-    if (tokens !== null) {
-      const loc = getCurrentResolvedLocation()
-      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
-      delete tokens[loc.path[1]]
-      setMetadataLocalStorage(login.metadata.LoginTokensV2, tokens)
-    }
-    setMetadata(presentation.metadata.Token, null)
-    setMetadataLocalStorage(login.metadata.LastToken, null)
-    setMetadataLocalStorage(login.metadata.LoginEndpoint, null)
-    setMetadataLocalStorage(login.metadata.LoginAccount, null)
-    void closeClient()
     Analytics.handleEvent(SettingsEvents.SignOut)
-    navigate({ path: [loginId] })
+    void logOut()
   }
   function selectWorkspace (): void {
     Analytics.handleEvent(SettingsEvents.SelectWorkspace)
diff --git a/plugins/workbench-resources/src/components/AccountPopup.svelte b/plugins/workbench-resources/src/components/AccountPopup.svelte
index e686a316098..29b90dc81fa 100644
--- a/plugins/workbench-resources/src/components/AccountPopup.svelte
+++ b/plugins/workbench-resources/src/components/AccountPopup.svelte
@@ -16,7 +16,7 @@
   import contact, { formatName } from '@hcengineering/contact'
   import { myEmployeeStore } from '@hcengineering/contact-resources'
   import { AccountRole, getCurrentAccount, hasAccountRole } from '@hcengineering/core'
-  import login from '@hcengineering/login'
+  import login, { loginId } from '@hcengineering/login'
   import { createQuery } from '@hcengineering/presentation'
   import setting, { SettingsCategory, settingId } from '@hcengineering/setting'
   import {
@@ -32,7 +32,7 @@
   } from '@hcengineering/ui'
   import view from '@hcengineering/view'
   import workbench from '../plugin'
-  import { signOut } from '../utils'
+  import { logOut } from '../utils'
   import HelpAndSupport from './HelpAndSupport.svelte'
 
   let items: SettingsCategory[] = []
@@ -143,7 +143,8 @@
         icon: setting.icon.Signout,
         label: setting.string.Signout,
         action: async () => {
-          signOut()
+          await logOut()
+          navigate({ path: [loginId] })
         },
         group: 'end'
       }
diff --git a/plugins/workbench-resources/src/components/ServerManagerServerStatistics.svelte b/plugins/workbench-resources/src/components/ServerManagerServerStatistics.svelte
index 841912306fc..cb368243a9f 100644
--- a/plugins/workbench-resources/src/components/ServerManagerServerStatistics.svelte
+++ b/plugins/workbench-resources/src/components/ServerManagerServerStatistics.svelte
@@ -4,7 +4,6 @@
   import presentation, { type OverviewStatistics } from '@hcengineering/presentation'
   import { Button, DropdownLabels, Expandable, IconArrowRight, ticker } from '@hcengineering/ui'
   import MetricsStats from './MetricsStats.svelte'
-  import type { MetricsData } from '@hcengineering/core'
 
   const token: string = getMetadata(presentation.metadata.Token) ?? ''
 
diff --git a/plugins/workbench-resources/src/components/ServerManagerUsers.svelte b/plugins/workbench-resources/src/components/ServerManagerUsers.svelte
index c03b6e54333..a194801d39d 100644
--- a/plugins/workbench-resources/src/components/ServerManagerUsers.svelte
+++ b/plugins/workbench-resources/src/components/ServerManagerUsers.svelte
@@ -6,7 +6,7 @@
   import { Button, CheckBox, ticker } from '@hcengineering/ui'
   import Expandable from '@hcengineering/ui/src/components/Expandable.svelte'
   import { FixedColumn, ObjectPresenter } from '@hcengineering/view-resources'
-  import { employeeByIdStore, personRefByPersonIdStore } from '@hcengineering/contact-resources'
+  import { personRefByPersonIdStore } from '@hcengineering/contact-resources'
   import { workspacesStore } from '../utils'
 
   const token: string = getMetadata(presentation.metadata.Token) ?? ''
@@ -24,7 +24,6 @@
   }
   let data: OverviewStatistics | undefined
   $: void fetchStats($ticker)
-  $: employees = $employeeByIdStore
   let realUsers: boolean
   let showActive5: boolean
 
diff --git a/plugins/workbench-resources/src/components/Workbench.svelte b/plugins/workbench-resources/src/components/Workbench.svelte
index e91bf4a9474..f1d2323f90a 100644
--- a/plugins/workbench-resources/src/components/Workbench.svelte
+++ b/plugins/workbench-resources/src/components/Workbench.svelte
@@ -26,7 +26,7 @@
     SortingOrder,
     Space
   } from '@hcengineering/core'
-  import login from '@hcengineering/login'
+  import login, { loginId } from '@hcengineering/login'
   import notification, { DocNotifyContext, InboxNotification, notificationId } from '@hcengineering/notification'
   import { BrowserNotificatator, InboxNotificationsClientImpl } from '@hcengineering/notification-resources'
   import { broadcastEvent, getMetadata, getResource, IntlString, translate } from '@hcengineering/platform'
@@ -100,7 +100,7 @@
   import { getContext, onDestroy, onMount, tick } from 'svelte'
   import { subscribeMobile } from '../mobile'
   import workbench from '../plugin'
-  import { buildNavModel, signOut, workspacesStore } from '../utils'
+  import { buildNavModel, logOut, workspacesStore } from '../utils'
   import AccountPopup from './AccountPopup.svelte'
   import AppItem from './AppItem.svelte'
   import AppSwitcher from './AppSwitcher.svelte'
@@ -760,7 +760,9 @@
       kind={'link'}
       size={'small'}
       on:click={() => {
-        signOut()
+        void logOut().then(() => {
+          navigate({ path: [loginId] })
+        })
       }}
     />
   </div>
diff --git a/plugins/workbench-resources/src/connect.ts b/plugins/workbench-resources/src/connect.ts
index 60f6e3bb39d..e184ff552de 100644
--- a/plugins/workbench-resources/src/connect.ts
+++ b/plugins/workbench-resources/src/connect.ts
@@ -19,7 +19,6 @@ import { setCurrentEmployee, ensureEmployee } from '@hcengineering/contact'
 import login, { loginId } from '@hcengineering/login'
 import { broadcastEvent, getMetadata, getResource, OK, setMetadata, translateCB } from '@hcengineering/platform'
 import presentation, {
-  closeClient,
   loadServerConfig,
   purgeClient,
   refreshClient,
@@ -30,7 +29,6 @@ import presentation, {
 } from '@hcengineering/presentation'
 import {
   desktopPlatform,
-  fetchMetadataLocalStorage,
   getCurrentLocation,
   locationStorageKeyId,
   navigate,
@@ -41,7 +39,7 @@ import { getClient as getAccountClient } from '@hcengineering/account-client'
 import { writable, get } from 'svelte/store'
 
 import plugin from './plugin'
-import { workspaceCreating } from './utils'
+import { logOut, workspaceCreating } from './utils'
 
 export const versionError = writable<string | undefined>(undefined)
 const versionStorageKey = 'last_server_version'
@@ -77,35 +75,26 @@ export async function connect (title: string): Promise<Client | undefined> {
       return
     }
   }
-  const tokens: Record<string, string> = fetchMetadataLocalStorage(login.metadata.LoginTokensV2) ?? {}
-  let token = tokens[wsUrl]
 
   const selectWorkspace = await getResource(login.function.SelectWorkspace)
-  const workspaceLoginInfo = await ctx.with(
-    'select-workspace',
-    {},
-    async () => (await selectWorkspace(wsUrl, token))[1]
-  )
+  const [, workspaceLoginInfo] = await ctx.with('select-workspace', {}, async () => await selectWorkspace(wsUrl, null))
 
   if (workspaceLoginInfo == null) {
     console.error(
       `Error selecting workspace ${wsUrl}. There might be something wrong with the token. Please try to log in again.`
     )
     // something went wrong with selecting workspace with the selected token
-    clearMetadata(wsUrl)
-    navigate({
-      path: [loginId]
-    })
+    await logOut()
+    navigate({ path: [loginId] })
     return
   }
 
-  tokens[wsUrl] = workspaceLoginInfo.token
-  token = workspaceLoginInfo.token
-  setMetadataLocalStorage(login.metadata.LoginTokensV2, tokens)
+  const token = workspaceLoginInfo.token
+
+  setMetadata(presentation.metadata.Token, workspaceLoginInfo.token)
   setMetadata(presentation.metadata.WorkspaceUuid, workspaceLoginInfo.workspace)
   setMetadata(presentation.metadata.WorkspaceDataId, workspaceLoginInfo.workspaceDataId)
   setMetadata(presentation.metadata.Endpoint, workspaceLoginInfo.endpoint)
-  setMetadata(presentation.metadata.Token, token)
 
   const fetchWorkspace = await getResource(login.function.FetchWorkspace)
   let workspace = await ctx.with('fetch-workspace', {}, async () => (await fetchWorkspace())[1])
@@ -230,10 +219,11 @@ export async function connect (title: string): Promise<Client | undefined> {
           location.reload()
         },
         onUnauthorized: () => {
-          clearMetadata(wsUrl)
-          navigate({
-            path: [loginId],
-            query: {}
+          void logOut().then(() => {
+            navigate({
+              path: [loginId],
+              query: {}
+            })
           })
         },
         onArchived: () => {
@@ -432,25 +422,3 @@ async function getGlobalPerson (): Promise<GlobalPerson | undefined> {
 
   return globalPerson
 }
-
-export function clearMetadata (ws: string): void {
-  const tokens = fetchMetadataLocalStorage(login.metadata.LoginTokensV2)
-  if (tokens !== null) {
-    const loc = getCurrentLocation()
-    // eslint-disable-next-line
-    delete tokens[loc.path[1]]
-    setMetadataLocalStorage(login.metadata.LoginTokensV2, tokens)
-  }
-  const currentWorkspace = getMetadata(presentation.metadata.WorkspaceUuid)
-  if (currentWorkspace !== undefined) {
-    setPresentationCookie('', currentWorkspace)
-  }
-
-  setMetadata(presentation.metadata.Token, null)
-  setMetadata(presentation.metadata.WorkspaceUuid, null)
-  setMetadata(presentation.metadata.WorkspaceDataId, null)
-  setMetadataLocalStorage(login.metadata.LastToken, null)
-  setMetadataLocalStorage(login.metadata.LoginEndpoint, null)
-  setMetadataLocalStorage(login.metadata.LoginAccount, null)
-  void closeClient()
-}
diff --git a/plugins/workbench-resources/src/index.ts b/plugins/workbench-resources/src/index.ts
index 1aaf49d2ffc..a9b31815bef 100644
--- a/plugins/workbench-resources/src/index.ts
+++ b/plugins/workbench-resources/src/index.ts
@@ -20,7 +20,7 @@ import Archive from './components/Archive.svelte'
 import SpacePanel from './components/navigator/SpacePanel.svelte'
 import SpecialView from './components/SpecialView.svelte'
 import WorkbenchApp from './components/WorkbenchApp.svelte'
-import { doNavigate } from './utils'
+import { doNavigate, logIn, logOut } from './utils'
 import Workbench from './components/Workbench.svelte'
 import ServerManager from './components/ServerManager.svelte'
 import WorkbenchTabs from './components/WorkbenchTabs.svelte'
@@ -44,7 +44,6 @@ export { default as SavedView } from './components/SavedView.svelte'
 
 export { SpecialView }
 
-export { clearMetadata } from './connect'
 export * from './utils'
 export * from './sidebar'
 export default async (): Promise<Resources> => ({
@@ -65,7 +64,9 @@ export default async (): Promise<Resources> => ({
     CreateWidgetTab: createWidgetTab,
     CloseWidgetTab: closeWidgetTab,
     CloseWidget: closeWidget,
-    GetSidebarObject: getSidebarObject
+    GetSidebarObject: getSidebarObject,
+    LogIn: logIn,
+    LogOut: logOut
   },
   actionImpl: {
     Navigate: doNavigate,
diff --git a/plugins/workbench-resources/src/utils.ts b/plugins/workbench-resources/src/utils.ts
index 9d2c774d0b6..940783e2000 100644
--- a/plugins/workbench-resources/src/utils.ts
+++ b/plugins/workbench-resources/src/utils.ts
@@ -14,6 +14,7 @@
 // limitations under the License.
 //
 
+import { getClient as getAccountClient } from '@hcengineering/account-client'
 import type {
   Account,
   Class,
@@ -25,12 +26,11 @@ import type {
   WorkspaceInfoWithStatus
 } from '@hcengineering/core'
 import core, { hasAccountRole } from '@hcengineering/core'
-import login, { loginId } from '@hcengineering/login'
-import { getResource, setMetadata } from '@hcengineering/platform'
-import presentation, { closeClient, getClient } from '@hcengineering/presentation'
+import login from '@hcengineering/login'
+import { getMetadata, getResource, setMetadata } from '@hcengineering/platform'
+import presentation, { closeClient, getClient, setPresentationCookie } from '@hcengineering/presentation'
 import {
   closePanel,
-  fetchMetadataLocalStorage,
   getCurrentLocation,
   type Location,
   location,
@@ -206,19 +206,29 @@ export async function buildNavModel (
   return newNavModel
 }
 
-export function signOut (): void {
-  const tokens = fetchMetadataLocalStorage(login.metadata.LoginTokensV2)
-  if (tokens !== null) {
-    const loc = getCurrentLocation()
-    const l = loc.path[1]
-    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
-    delete tokens[l]
-    setMetadataLocalStorage(login.metadata.LoginTokensV2, tokens)
+export async function logIn (loginInfo: { account: string, token?: string }): Promise<void> {
+  const accountsUrl = getMetadata(login.metadata.AccountsUrl)
+  await getAccountClient(accountsUrl, loginInfo.token).setCookie()
+
+  setMetadata(presentation.metadata.Token, loginInfo.token)
+  setMetadataLocalStorage(login.metadata.LastAccount, loginInfo.account)
+  setMetadataLocalStorage(login.metadata.LoginAccount, loginInfo.account)
+}
+
+export async function logOut (): Promise<void> {
+  const accountsUrl = getMetadata(login.metadata.AccountsUrl)
+  await getAccountClient(accountsUrl).deleteCookie()
+
+  const currentWorkspace = getMetadata(presentation.metadata.WorkspaceUuid)
+  if (currentWorkspace !== undefined) {
+    setPresentationCookie('', currentWorkspace)
   }
+
   setMetadata(presentation.metadata.Token, null)
-  setMetadataLocalStorage(login.metadata.LastToken, null)
+  setMetadata(presentation.metadata.WorkspaceUuid, null)
+  setMetadata(presentation.metadata.WorkspaceDataId, null)
   setMetadataLocalStorage(login.metadata.LoginEndpoint, null)
   setMetadataLocalStorage(login.metadata.LoginAccount, null)
+
   void closeClient()
-  navigate({ path: [loginId] })
 }
diff --git a/plugins/workbench/src/index.ts b/plugins/workbench/src/index.ts
index c9f26660462..735411078c7 100644
--- a/plugins/workbench/src/index.ts
+++ b/plugins/workbench/src/index.ts
@@ -13,296 +13,12 @@
 // limitations under the License.
 //
 
-import type { AccountRole, Class, Doc, Mixin, Obj, PersonId, Ref, Space, Tx } from '@hcengineering/core'
-import { DocNotifyContext, InboxNotification } from '@hcengineering/notification'
-import type { Asset, IntlString, Metadata, Plugin, Resource } from '@hcengineering/platform'
-import { plugin } from '@hcengineering/platform'
-import type { Preference } from '@hcengineering/preference'
-import {
-  AnyComponent,
-  type AnySvelteComponent,
-  ComponentExtensionId,
-  Location,
-  ResolvedLocation
-} from '@hcengineering/ui'
-import { ViewAction } from '@hcengineering/view'
-
-/**
- * @public
- */
-
-export interface LocationData {
-  objectId?: Ref<Doc>
-  objectClass?: Ref<Class<Doc>>
-  name?: string
-  nameIntl?: IntlString
-  icon?: Asset
-  iconComponent?: AnyComponent
-  iconProps?: Record<string, any>
-}
-
-export interface Application extends Doc {
-  label: IntlString
-  alias: string
-  icon: Asset
-  hidden: boolean
-  position?: 'top' | 'mid'
-
-  // Also attached ApplicationNavModel will be joined after this one main.
-  navigatorModel?: NavigatorModel
-
-  locationResolver?: Resource<(loc: Location) => Promise<ResolvedLocation | undefined>>
-  locationDataResolver?: Resource<(loc: Location) => Promise<LocationData>>
-
-  // Component will be displayed in case navigator model is not defined, or nothing is selected in navigator model
-  component?: AnyComponent
-
-  navHeaderComponent?: AnyComponent
-  accessLevel?: AccountRole
-  navFooterComponent?: AnyComponent
-}
-
-export enum WidgetType {
-  Fixed = 'fixed', // Fixed sidebar are always visible
-  Flexible = 'flexible', // Flexible sidebar are visible only in special cases (during the meeting, etc.)
-  Configurable = 'configurable ' // Configurable might be fixed in sidebar by user in preferences
-}
-
-export interface Widget extends Doc {
-  label: IntlString
-  icon: Asset
-  type: WidgetType
-
-  component: AnyComponent
-  tabComponent?: AnyComponent
-  switcherComponent?: AnyComponent
-  headerLabel?: IntlString
-
-  closeIfNoTabs?: boolean
-  onTabClose?: Resource<(tab: WidgetTab) => Promise<void>>
-}
-
-export interface WidgetPreference extends Preference {
-  enabled: boolean
-}
-
-export interface WidgetTab {
-  id: string
-  name?: string
-  label?: IntlString
-  icon?: Asset | AnySvelteComponent
-  iconComponent?: AnyComponent
-  iconProps?: Record<string, any>
-  isPinned?: boolean
-  allowedPath?: string
-  objectId?: Ref<Doc>
-  objectClass?: Ref<Class<Doc>>
-  data?: Record<string, any>
-  readonly?: boolean
-}
-
-export enum SidebarEvent {
-  OpenWidget = 'openWidget'
-}
-
-export interface OpenSidebarWidgetParams {
-  widget: Ref<Widget>
-  tab?: WidgetTab
-}
-
-export interface TxSidebarEvent<T extends Record<string, any> = Record<string, any>> extends Tx {
-  event: SidebarEvent
-  params: T
-}
-
-export interface WorkbenchTab extends Preference {
-  attachedTo: PersonId
-  location: string
-  isPinned: boolean
-  name?: string
-}
-
-/**
- * @public
- */
-export interface ApplicationNavModel extends Doc {
-  extends: Ref<Application>
-
-  spaces?: SpacesNavModel[]
-  specials?: SpecialNavModel[]
-}
-
-/**
- * @public
- */
-export interface HiddenApplication extends Preference {
-  attachedTo: Ref<Application>
-}
-
-/**
- * @public
- */
-export interface SpacesNavModel {
-  id: string // Id could be used for extending of navigation model
-  label?: IntlString
-  spaceClass: Ref<Class<Space>>
-  addSpaceLabel?: IntlString
-  createComponent?: AnyComponent
-  icon?: Asset
-
-  // Child special items.
-  specials?: SpecialNavModel[]
-
-  visibleIf?: Resource<(space: Space) => Promise<boolean>>
-}
-
-/**
- * @public
- */
-export interface NavigatorModel {
-  spaces: SpacesNavModel[]
-  specials?: SpecialNavModel[]
-}
-
-/**
- * @public
- */
-export interface SpecialNavModel {
-  id: string // Uniq id
-  label: IntlString
-  icon?: Asset
-  accessLevel?: AccountRole
-  component: AnyComponent
-  componentProps?: Record<string, any>
-  // If not top and bottom, position will be sorted alphabetically.
-  position?: 'top' | 'bottom' | string // undefined == 'top
-  visibleIf?: Resource<(spaces: Space[]) => Promise<boolean>>
-  // If defined, will be used to find spaces for visibleIf
-  spaceClass?: Ref<Class<Space>>
-  checkIsDisabled?: Resource<() => Promise<boolean>>
-  notificationsCountProvider?: Resource<
-  (inboxNotificationsByContext: Map<Ref<DocNotifyContext>, InboxNotification[]>) => number
-  >
-  navigationModel?: ParentsNavigationModel
-  queryOptions?: QueryOptions
-}
-
-/**
- * @public
- */
-export interface ParentsNavigationModel {
-  navigationComponent: AnyComponent
-  navigationComponentLabel: IntlString
-  navigationComponentIcon?: Asset
-  mainComponentLabel: IntlString
-  mainComponentIcon?: Asset
-  navigationComponentProps?: Record<string, any>
-  syncWithLocationQuery?: boolean
-  createComponent?: AnyComponent
-  createComponentProps?: Record<string, any>
-  createButton?: AnyComponent
-}
-
-/**
- * @public
- */
-export interface QueryOptions {
-  // If specified should display only documents from the current space
-  filterBySpace?: boolean
-}
-
-/**
- * @public
- */
-export interface ViewConfiguration {
-  class: Ref<Class<Doc>> // show object of this class
-  createItemDialog?: AnyComponent
-  createItemLabel?: IntlString
-
-  // If defined component will be used to render content for selected space.
-  component?: AnyComponent
-  componentProps?: Record<string, any>
-}
-
-/**
- * @public
- */
-export interface SpaceView extends Class<Obj> {
-  view: ViewConfiguration
-}
-
-/**
- * @public
- */
-export const workbenchId = 'workbench' as Plugin
+import { workbenchId, workbenchPlugin } from './plugin'
 
 export * from './analytics'
+export * from './types'
+export * from './utils'
+
+export { workbenchId }
 
-export default plugin(workbenchId, {
-  class: {
-    Application: '' as Ref<Class<Application>>,
-    ApplicationNavModel: '' as Ref<Class<ApplicationNavModel>>,
-    HiddenApplication: '' as Ref<Class<HiddenApplication>>,
-    Widget: '' as Ref<Class<Widget>>,
-    WidgetPreference: '' as Ref<Class<WidgetPreference>>,
-    TxSidebarEvent: '' as Ref<Class<TxSidebarEvent<Record<string, any>>>>,
-    WorkbenchTab: '' as Ref<Class<WorkbenchTab>>
-  },
-  mixin: {
-    SpaceView: '' as Ref<Mixin<SpaceView>>
-  },
-  component: {
-    WorkbenchApp: '' as AnyComponent,
-    InviteLink: '' as AnyComponent,
-    Archive: '' as AnyComponent,
-    SpecialView: '' as AnyComponent
-  },
-  string: {
-    Archive: '' as IntlString,
-    View: '' as IntlString,
-    ServerUnderMaintenance: '' as IntlString,
-    UpgradeDownloadProgress: '' as IntlString,
-    OpenInSidebar: '' as IntlString,
-    OpenInSidebarNewTab: '' as IntlString,
-    ConfigureWidgets: '' as IntlString,
-    WorkspaceIsArchived: '' as IntlString,
-    WorkspaceIsMigrating: '' as IntlString
-  },
-  icon: {
-    Search: '' as Asset
-  },
-  event: {
-    NotifyConnection: '' as Metadata<string>,
-    NotifyTitle: '' as Metadata<string>
-  },
-  metadata: {
-    PlatformTitle: '' as Metadata<string>,
-    ExcludedApplications: '' as Metadata<Ref<Application>[]>,
-    DefaultApplication: '' as Metadata<string>,
-    DefaultSpace: '' as Metadata<Ref<Space>>,
-    DefaultSpecial: '' as Metadata<string>,
-    // Default for navigation expanded state
-    NavigationExpandedDefault: '' as Metadata<boolean>
-  },
-  extensions: {
-    WorkbenchExtensions: '' as ComponentExtensionId,
-    WorkbenchTabExtensions: '' as ComponentExtensionId
-  },
-  function: {
-    CreateWidgetTab: '' as Resource<(widget: Widget, tab: WidgetTab, newTab: boolean) => Promise<void>>,
-    CloseWidgetTab: '' as Resource<(widget: Widget, tab: string) => Promise<void>>,
-    CloseWidget: '' as Resource<(widget: Ref<Widget>) => Promise<void>>,
-    GetSidebarObject: '' as Resource<() => Partial<Pick<Doc, '_id' | '_class'>>>
-  },
-  actionImpl: {
-    Navigate: '' as ViewAction<{
-      mode: 'app' | 'special' | 'space'
-      application?: string
-      special?: string
-      space?: Ref<Space>
-      // If no space is selected, select first space from list
-      spaceClass?: Ref<Class<Space>>
-      spaceSpecial?: string
-    }>
-  }
-})
+export default workbenchPlugin
diff --git a/plugins/workbench/src/plugin.ts b/plugins/workbench/src/plugin.ts
new file mode 100644
index 00000000000..2e7e1382ce7
--- /dev/null
+++ b/plugins/workbench/src/plugin.ts
@@ -0,0 +1,108 @@
+//
+// Copyright © 2020, 2021 Anticrm Platform Contributors.
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import type { Class, Doc, Mixin, Ref, Space } from '@hcengineering/core'
+import type { Asset, IntlString, Metadata, Plugin, Resource } from '@hcengineering/platform'
+import { plugin } from '@hcengineering/platform'
+import { AnyComponent, ComponentExtensionId } from '@hcengineering/ui'
+import { ViewAction } from '@hcengineering/view'
+
+import type {
+  Application,
+  ApplicationNavModel,
+  HiddenApplication,
+  SpaceView,
+  TxSidebarEvent,
+  Widget,
+  WidgetPreference,
+  WidgetTab,
+  WorkbenchTab
+} from './types'
+
+/** @public */
+export const workbenchId = 'workbench' as Plugin
+
+/** @public */
+export const workbenchPlugin = plugin(workbenchId, {
+  class: {
+    Application: '' as Ref<Class<Application>>,
+    ApplicationNavModel: '' as Ref<Class<ApplicationNavModel>>,
+    HiddenApplication: '' as Ref<Class<HiddenApplication>>,
+    Widget: '' as Ref<Class<Widget>>,
+    WidgetPreference: '' as Ref<Class<WidgetPreference>>,
+    TxSidebarEvent: '' as Ref<Class<TxSidebarEvent<Record<string, any>>>>,
+    WorkbenchTab: '' as Ref<Class<WorkbenchTab>>
+  },
+  mixin: {
+    SpaceView: '' as Ref<Mixin<SpaceView>>
+  },
+  component: {
+    WorkbenchApp: '' as AnyComponent,
+    InviteLink: '' as AnyComponent,
+    Archive: '' as AnyComponent,
+    SpecialView: '' as AnyComponent
+  },
+  string: {
+    Archive: '' as IntlString,
+    View: '' as IntlString,
+    ServerUnderMaintenance: '' as IntlString,
+    UpgradeDownloadProgress: '' as IntlString,
+    OpenInSidebar: '' as IntlString,
+    OpenInSidebarNewTab: '' as IntlString,
+    ConfigureWidgets: '' as IntlString,
+    WorkspaceIsArchived: '' as IntlString,
+    WorkspaceIsMigrating: '' as IntlString
+  },
+  icon: {
+    Search: '' as Asset
+  },
+  event: {
+    NotifyConnection: '' as Metadata<string>,
+    NotifyTitle: '' as Metadata<string>
+  },
+  metadata: {
+    PlatformTitle: '' as Metadata<string>,
+    ExcludedApplications: '' as Metadata<Ref<Application>[]>,
+    DefaultApplication: '' as Metadata<string>,
+    DefaultSpace: '' as Metadata<Ref<Space>>,
+    DefaultSpecial: '' as Metadata<string>,
+    // Default for navigation expanded state
+    NavigationExpandedDefault: '' as Metadata<boolean>
+  },
+  extensions: {
+    WorkbenchExtensions: '' as ComponentExtensionId,
+    WorkbenchTabExtensions: '' as ComponentExtensionId
+  },
+  function: {
+    CreateWidgetTab: '' as Resource<(widget: Widget, tab: WidgetTab, newTab: boolean) => Promise<void>>,
+    CloseWidgetTab: '' as Resource<(widget: Widget, tab: string) => Promise<void>>,
+    CloseWidget: '' as Resource<(widget: Ref<Widget>) => Promise<void>>,
+    GetSidebarObject: '' as Resource<() => Partial<Pick<Doc, '_id' | '_class'>>>,
+    LogIn: '' as Resource<(loginInfo: { account: string, token?: string }) => Promise<void>>,
+    LogOut: '' as Resource<() => Promise<void>>
+  },
+  actionImpl: {
+    Navigate: '' as ViewAction<{
+      mode: 'app' | 'special' | 'space'
+      application?: string
+      special?: string
+      space?: Ref<Space>
+      // If no space is selected, select first space from list
+      spaceClass?: Ref<Class<Space>>
+      spaceSpecial?: string
+    }>
+  }
+})
diff --git a/plugins/workbench/src/types.ts b/plugins/workbench/src/types.ts
new file mode 100644
index 00000000000..1b174475dd4
--- /dev/null
+++ b/plugins/workbench/src/types.ts
@@ -0,0 +1,213 @@
+//
+// Copyright © 2020, 2021 Anticrm Platform Contributors.
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import type { AccountRole, Class, Doc, Obj, PersonId, Ref, Space, Tx } from '@hcengineering/core'
+import { DocNotifyContext, InboxNotification } from '@hcengineering/notification'
+import type { Asset, IntlString, Resource } from '@hcengineering/platform'
+import type { Preference } from '@hcengineering/preference'
+import { AnyComponent, type AnySvelteComponent, Location, ResolvedLocation } from '@hcengineering/ui'
+
+/** @public */
+export interface LocationData {
+  objectId?: Ref<Doc>
+  objectClass?: Ref<Class<Doc>>
+  name?: string
+  nameIntl?: IntlString
+  icon?: Asset
+  iconComponent?: AnyComponent
+  iconProps?: Record<string, any>
+}
+
+/** @public */
+export interface Application extends Doc {
+  label: IntlString
+  alias: string
+  icon: Asset
+  hidden: boolean
+  position?: 'top' | 'mid'
+
+  // Also attached ApplicationNavModel will be joined after this one main.
+  navigatorModel?: NavigatorModel
+
+  locationResolver?: Resource<(loc: Location) => Promise<ResolvedLocation | undefined>>
+  locationDataResolver?: Resource<(loc: Location) => Promise<LocationData>>
+
+  // Component will be displayed in case navigator model is not defined, or nothing is selected in navigator model
+  component?: AnyComponent
+
+  navHeaderComponent?: AnyComponent
+  accessLevel?: AccountRole
+  navFooterComponent?: AnyComponent
+}
+
+/** @public */
+export enum WidgetType {
+  Fixed = 'fixed', // Fixed sidebar are always visible
+  Flexible = 'flexible', // Flexible sidebar are visible only in special cases (during the meeting, etc.)
+  Configurable = 'configurable ' // Configurable might be fixed in sidebar by user in preferences
+}
+
+/** @public */
+export interface Widget extends Doc {
+  label: IntlString
+  icon: Asset
+  type: WidgetType
+
+  component: AnyComponent
+  tabComponent?: AnyComponent
+  switcherComponent?: AnyComponent
+  headerLabel?: IntlString
+
+  closeIfNoTabs?: boolean
+  onTabClose?: Resource<(tab: WidgetTab) => Promise<void>>
+}
+
+/** @public */
+export interface WidgetPreference extends Preference {
+  enabled: boolean
+}
+
+/** @public */
+export interface WidgetTab {
+  id: string
+  name?: string
+  label?: IntlString
+  icon?: Asset | AnySvelteComponent
+  iconComponent?: AnyComponent
+  iconProps?: Record<string, any>
+  isPinned?: boolean
+  allowedPath?: string
+  objectId?: Ref<Doc>
+  objectClass?: Ref<Class<Doc>>
+  data?: Record<string, any>
+  readonly?: boolean
+}
+
+/** @public */
+export enum SidebarEvent {
+  OpenWidget = 'openWidget'
+}
+
+/** @public */
+export interface OpenSidebarWidgetParams {
+  widget: Ref<Widget>
+  tab?: WidgetTab
+}
+
+/** @public */
+export interface TxSidebarEvent<T extends Record<string, any> = Record<string, any>> extends Tx {
+  event: SidebarEvent
+  params: T
+}
+
+/** @public */
+export interface WorkbenchTab extends Preference {
+  attachedTo: PersonId
+  location: string
+  isPinned: boolean
+  name?: string
+}
+
+/** @public */
+export interface ApplicationNavModel extends Doc {
+  extends: Ref<Application>
+
+  spaces?: SpacesNavModel[]
+  specials?: SpecialNavModel[]
+}
+
+/** @public */
+export interface HiddenApplication extends Preference {
+  attachedTo: Ref<Application>
+}
+
+/** @public */
+export interface SpacesNavModel {
+  id: string // Id could be used for extending of navigation model
+  label?: IntlString
+  spaceClass: Ref<Class<Space>>
+  addSpaceLabel?: IntlString
+  createComponent?: AnyComponent
+  icon?: Asset
+
+  // Child special items.
+  specials?: SpecialNavModel[]
+
+  visibleIf?: Resource<(space: Space) => Promise<boolean>>
+}
+
+/** @public */
+export interface NavigatorModel {
+  spaces: SpacesNavModel[]
+  specials?: SpecialNavModel[]
+}
+
+/** @public */
+export interface SpecialNavModel {
+  id: string // Uniq id
+  label: IntlString
+  icon?: Asset
+  accessLevel?: AccountRole
+  component: AnyComponent
+  componentProps?: Record<string, any>
+  // If not top and bottom, position will be sorted alphabetically.
+  position?: 'top' | 'bottom' | string // undefined == 'top
+  visibleIf?: Resource<(spaces: Space[]) => Promise<boolean>>
+  // If defined, will be used to find spaces for visibleIf
+  spaceClass?: Ref<Class<Space>>
+  checkIsDisabled?: Resource<() => Promise<boolean>>
+  notificationsCountProvider?: Resource<
+  (inboxNotificationsByContext: Map<Ref<DocNotifyContext>, InboxNotification[]>) => number
+  >
+  navigationModel?: ParentsNavigationModel
+  queryOptions?: QueryOptions
+}
+
+/** @public */
+export interface ParentsNavigationModel {
+  navigationComponent: AnyComponent
+  navigationComponentLabel: IntlString
+  navigationComponentIcon?: Asset
+  mainComponentLabel: IntlString
+  mainComponentIcon?: Asset
+  navigationComponentProps?: Record<string, any>
+  syncWithLocationQuery?: boolean
+  createComponent?: AnyComponent
+  createComponentProps?: Record<string, any>
+  createButton?: AnyComponent
+}
+
+/** @public */
+export interface QueryOptions {
+  // If specified should display only documents from the current space
+  filterBySpace?: boolean
+}
+
+/** @public */
+export interface ViewConfiguration {
+  class: Ref<Class<Doc>> // show object of this class
+  createItemDialog?: AnyComponent
+  createItemLabel?: IntlString
+
+  // If defined component will be used to render content for selected space.
+  component?: AnyComponent
+  componentProps?: Record<string, any>
+}
+
+/** @public */
+export interface SpaceView extends Class<Obj> {
+  view: ViewConfiguration
+}
diff --git a/plugins/workbench/src/utils.ts b/plugins/workbench/src/utils.ts
new file mode 100644
index 00000000000..31a1718a6f1
--- /dev/null
+++ b/plugins/workbench/src/utils.ts
@@ -0,0 +1,29 @@
+//
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import { getResource } from '@hcengineering/platform'
+import { workbenchPlugin as plugin } from './plugin'
+
+/** @public */
+export async function logIn (loginInfo: { account: string, token?: string }): Promise<void> {
+  const res = await getResource(plugin.function.LogIn)
+  await res(loginInfo)
+}
+
+/** @public */
+export async function logOut (): Promise<void> {
+  const res = await getResource(plugin.function.LogOut)
+  await res()
+}
diff --git a/pods/fulltext/run.sh b/pods/fulltext/run.sh
index 2133b2a1310..aaa939f3f08 100755
--- a/pods/fulltext/run.sh
+++ b/pods/fulltext/run.sh
@@ -8,7 +8,7 @@ export SERVER_SECRET=secret
 export REKONI_URL=http://localhost:4004
 export MODEL_JSON=./bundle/model.json
 export ELASTIC_INDEX_NAME=local_storage_index
-export STATS_URL=http://host.docker.internal:4900
+export STATS_URL=http://huly.local:4900
 export ACCOUNTS_URL=http://localhost:3000
 rushx bundle
 node --inspect ./bundle/bundle.js
\ No newline at end of file
diff --git a/pods/green/src/index.ts b/pods/green/src/index.ts
index 98b276c4e8f..e75d50aa46c 100644
--- a/pods/green/src/index.ts
+++ b/pods/green/src/index.ts
@@ -5,7 +5,7 @@ import http from 'node:http'
 
 const port = parseInt(process.env.PORT ?? '6767')
 const version = process.env.VERSION ?? '0.6.388'
-const dbUrl = process.env.DB_URL ?? 'postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable'
+const dbUrl = process.env.DB_URL ?? 'postgresql://root@huly.local:26257/defaultdb?sslmode=disable'
 const extraOptions = JSON.parse(process.env.DB_OPTIONS ?? '{}')
 
 const authToken = process.env.AUTH_TOKEN ?? 'secret'
diff --git a/pods/server/package.json b/pods/server/package.json
index ca611797948..50c7a7d2ccc 100644
--- a/pods/server/package.json
+++ b/pods/server/package.json
@@ -8,8 +8,8 @@
   "template": "@hcengineering/node-package",
   "license": "EPL-2.0",
   "scripts": {
-    "start": "rush bundle --to @hcengineering/pod-server && cross-env NODE_ENV=production MODEL_VERSION=$(node ../../common/scripts/show_version.js) ACCOUNTS_URL=http://localhost:3000 REKONI_URL=http://localhost:4004 MONGO_URL=mongodb://localhost:27017 DB_URL=mongodb://localhost:27017 FRONT_URL=http://localhost:8087 UPLOAD_URL=/upload MINIO_ENDPOINT=localhost MINIO_ACCESS_KEY=minioadmin MINIO_SECRET_KEY=minioadmin METRICS_CONSOLE=true SERVER_SECRET=secret OPERATION_PROFILING=false MODEL_JSON=../../models/all/bundle/model.json STATS_URL=http://host.docker.internal:4900 node --inspect bundle/bundle.js",
-    "start-cr": "rush bundle --to @hcengineering/pod-server && cross-env NODE_ENV=production MODEL_VERSION=$(node ../../common/scripts/show_version.js) ACCOUNTS_URL=http://localhost:3000 REKONI_URL=http://localhost:4004 DB_URL=postgresql://root@host.docker.internal:26257/defaultdb?sslmode=disable FRONT_URL=http://localhost:8087 UPLOAD_URL=/upload MINIO_ENDPOINT=localhost MINIO_ACCESS_KEY=minioadmin MINIO_SECRET_KEY=minioadmin METRICS_CONSOLE=true SERVER_SECRET=secret OPERATION_PROFILING=false MODEL_JSON=../../models/all/bundle/model.json STATS_URL=http://host.docker.internal:4900 FULLTEXT_URL=http://host.docker.internal:4702 SERVER_PORT=3332 node --inspect bundle/bundle.js",
+    "start": "rush bundle --to @hcengineering/pod-server && cross-env NODE_ENV=production MODEL_VERSION=$(node ../../common/scripts/show_version.js) ACCOUNTS_URL=http://localhost:3000 REKONI_URL=http://localhost:4004 MONGO_URL=mongodb://localhost:27017 DB_URL=mongodb://localhost:27017 FRONT_URL=http://localhost:8087 UPLOAD_URL=/upload MINIO_ENDPOINT=localhost MINIO_ACCESS_KEY=minioadmin MINIO_SECRET_KEY=minioadmin METRICS_CONSOLE=true SERVER_SECRET=secret OPERATION_PROFILING=false MODEL_JSON=../../models/all/bundle/model.json STATS_URL=http://huly.local:4900 node --inspect bundle/bundle.js",
+    "start-cr": "rush bundle --to @hcengineering/pod-server && cross-env NODE_ENV=production MODEL_VERSION=$(node ../../common/scripts/show_version.js) ACCOUNTS_URL=http://localhost:3000 REKONI_URL=http://localhost:4004 DB_URL=postgresql://root@huly.local:26257/defaultdb?sslmode=disable FRONT_URL=http://localhost:8087 UPLOAD_URL=/upload MINIO_ENDPOINT=localhost MINIO_ACCESS_KEY=minioadmin MINIO_SECRET_KEY=minioadmin METRICS_CONSOLE=true SERVER_SECRET=secret OPERATION_PROFILING=false MODEL_JSON=../../models/all/bundle/model.json STATS_URL=http://huly.local:4900 FULLTEXT_URL=http://huly.local:4702 SERVER_PORT=3332 node --inspect bundle/bundle.js",
     "start-flame": "rush bundle --to @hcengineering/pod-server && cross-env NODE_ENV=production MODEL_VERSION=$(node ../../common/scripts/show_version.js) ACCOUNTS_URL=http://localhost:3000 REKONI_URL=http://localhost:4004 MONGO_URL=mongodb://localhost:27017 FRONT_URL=http://localhost:8087 UPLOAD_URL=/upload MINIO_ENDPOINT=localhost MINIO_ACCESS_KEY=minioadmin MINIO_SECRET_KEY=minioadmin METRICS_CONSOLE=true SERVER_SECRET=secret MODEL_JSON=../../models/all/bundle/model.json clinic flame --dest ./out -- node --nolazy -r ts-node/register --enable-source-maps src/__start.ts",
     "start-raw": "ts-node src/__start.ts",
     "build": "compile",
diff --git a/qms-tests/branding-test.json b/qms-tests/branding-test.json
index 35865e70f16..14916a3bcc3 100644
--- a/qms-tests/branding-test.json
+++ b/qms-tests/branding-test.json
@@ -42,7 +42,7 @@
       }
     ]
   },
-  "host.docker.internal:8083": {
+  "huly.local:8083": {
     "key": "tracex-docker",
     "title": "TraceX",
     "protocol": "http",
diff --git a/qms-tests/docker-compose.yaml b/qms-tests/docker-compose.yaml
index 09327d525cb..14b26d58a30 100644
--- a/qms-tests/docker-compose.yaml
+++ b/qms-tests/docker-compose.yaml
@@ -3,7 +3,7 @@ services:
   mongodb:
     image: 'mongo:7-jammy'
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     command: mongod --port 27018
     environment:
       - PUID=1000
@@ -41,7 +41,7 @@ services:
   account:
     image: hardcoreeng/account
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     pull_policy: never
     links:
       - mongodb
@@ -54,14 +54,14 @@ services:
       - ACCOUNT_PORT=3003
       - SERVER_SECRET=secret
       - DB_URL=mongodb://mongodb:27018
-      - TRANSACTOR_URL=ws://transactor:3334;ws://host.docker.internal:3334
+      - TRANSACTOR_URL=ws://transactor:3334;ws://huly.local:3334
       - STORAGE_CONFIG=${STORAGE_CONFIG}
       - MODEL_ENABLED=*
       - BRANDING_PATH=/var/cfg/branding-test.json
   workspace:
     image: hardcoreeng/workspace
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     links:
       - mongodb
       - minio
@@ -71,7 +71,7 @@ services:
       - SERVER_SECRET=secret
       - DB_URL=mongodb://mongodb:27018
       - MONGO_URL=mongodb://mongodb:27018
-      - TRANSACTOR_URL=ws://transactor:3334;ws://host.docker.internal:3334
+      - TRANSACTOR_URL=ws://transactor:3334;ws://huly.local:3334
       - STORAGE_CONFIG=${STORAGE_CONFIG}
       - MODEL_ENABLED=*
       - ACCOUNTS_URL=http://account:3003
@@ -80,7 +80,7 @@ services:
   front:
     image: hardcoreeng/front
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     pull_policy: never
     links:
       - account
@@ -96,22 +96,22 @@ services:
     environment:
       - SERVER_PORT=8083
       - SERVER_SECRET=secret
-      - ACCOUNTS_URL=http://host.docker.internal:3003
+      - ACCOUNTS_URL=http://huly.local:3003
       - MONGO_URL=mongodb://mongodb:27018
       - UPLOAD_URL=/files
-      - GMAIL_URL=http://host.docker.internal:8088
-      - CALENDAR_URL=http://host.docker.internal:8095
+      - GMAIL_URL=http://huly.local:8088
+      - CALENDAR_URL=http://huly.local:8095
       - REKONI_URL=http://rekoni:4007
-      - TELEGRAM_URL=http://host.docker.internal:8086
-      - COLLABORATOR_URL=ws://host.docker.internal:3079
+      - TELEGRAM_URL=http://huly.local:8086
+      - COLLABORATOR_URL=ws://huly.local:3079
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - BRANDING_URL=http://host.docker.internal:8083/branding-test.json
-      - PRINT_URL=http://host.docker.internal:4003
-      - SIGN_URL=http://host.docker.internal:4008
+      - BRANDING_URL=http://huly.local:8083/branding-test.json
+      - PRINT_URL=http://huly.local:4003
+      - SIGN_URL=http://huly.local:4008
   transactor:
     image: hardcoreeng/transactor
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     pull_policy: never
     links:
       - mongodb
@@ -130,8 +130,8 @@ services:
       - METRICS_CONSOLE=false
       - METRICS_FILE=metrics.txt
       - STORAGE_CONFIG=${STORAGE_CONFIG}
-      - FRONT_URL=http://host.docker.internal:8083
-      - UPLOAD_URL=http://host.docker.internal:8083/files
+      - FRONT_URL=http://huly.local:8083
+      - UPLOAD_URL=http://huly.local:8083/files
       - ACCOUNTS_URL=http://account:3003
       - LAST_NAME_FIRST=true
       - FULLTEXT_URL=http://fulltext:4710
@@ -139,7 +139,7 @@ services:
   collaborator:
     image: hardcoreeng/collaborator
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     links:
       - mongodb
       - minio
@@ -162,7 +162,7 @@ services:
   print:
     image: hardcoreeng/print
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     restart: unless-stopped
     ports:
       - 4003:4005
@@ -179,7 +179,7 @@ services:
   sign:
     image: hardcoreeng/sign
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "huly.local:host-gateway"
     restart: unless-stopped
     ports:
       - 4008:4006
diff --git a/qms-tests/sanity/.env b/qms-tests/sanity/.env
index 7aa9c53c686..1bba2d5c163 100644
--- a/qms-tests/sanity/.env
+++ b/qms-tests/sanity/.env
@@ -1,5 +1,5 @@
-PLATFORM_URI='http://host.docker.internal:8083'
-PLATFORM_TRANSACTOR='ws://host.docker.internal:3334'
+PLATFORM_URI='http://huly.local:8083'
+PLATFORM_TRANSACTOR='ws://huly.local:3334'
 PLATFORM_USER='user1'
 PLATFORM_USER_SECOND='user2'
 PLATFORM_USER_THIRD='user3'
diff --git a/qms-tests/sanity/package.json b/qms-tests/sanity/package.json
index 5c17164ae75..5e81d982fe2 100644
--- a/qms-tests/sanity/package.json
+++ b/qms-tests/sanity/package.json
@@ -19,13 +19,13 @@
     "format": "format tests",
     "ci": "playwright install --with-deps chromium",
     "test": "",
-    "uitest": "cross-env LOCAL_URL=http://host.docker.internal:3003/ DEV_URL= playwright test -c ./tests/playwright.config.ts --grep-invert @PDF",
-    "uitest-pdf": "cross-env LOCAL_URL=http://host.docker.internal:3003/ DEV_URL= playwright test -c ./tests/playwright.config.ts --grep @PDF",
+    "uitest": "cross-env LOCAL_URL=http://huly.local:3003/ DEV_URL= playwright test -c ./tests/playwright.config.ts --grep-invert @PDF",
+    "uitest-pdf": "cross-env LOCAL_URL=http://huly.local:3003/ DEV_URL= playwright test -c ./tests/playwright.config.ts --grep @PDF",
     "staging-uitest": "cross-env PLATFORM_URI=https://front.hc.engineering/ playwright test -c ./tests/playwright.config.ts --grep @staging --grep-invert @PDF",
-    "dev-uitest": "cross-env PLATFORM_URI=http://localhost:8081 PLATFORM_TRANSACTOR=ws://host.docker.internal:3333 DEV_URL=http://localhost:8080/account playwright test -c ./tests/playwright.config.ts --grep-invert @PDF",
+    "dev-uitest": "cross-env PLATFORM_URI=http://localhost:8081 PLATFORM_TRANSACTOR=ws://localhost:3333 DEV_URL=http://localhost:8080/account playwright test -c ./tests/playwright.config.ts --grep-invert @PDF",
     "debug": "playwright test -c ./tests/playwright.config.ts --debug --headed",
-    "dev-debug": "cross-env PLATFORM_URI=http://localhost:8081 PLATFORM_TRANSACTOR=ws://host.docker.internal:3333 playwright test -c ./tests/playwright.config.ts --debug --headed",
-    "codegen": "playwright codegen --load-storage storage.json http://host.docker.internal:8083/workbench/sanity-ws/",
+    "dev-debug": "cross-env PLATFORM_URI=http://localhost:8081 PLATFORM_TRANSACTOR=ws://huly.local:3333 playwright test -c ./tests/playwright.config.ts --debug --headed",
+    "codegen": "playwright codegen --load-storage storage.json http://huly.local:8083/workbench/sanity-ws/",
     "dev-codegen": "cross-env playwright codegen --load-storage storage-dev.json http://localhost:8080/workbench/sanity-ws/",
     "allure:generate": "allure generate allure-results -o allure-report --clean"
   },
diff --git a/server/account-service/package.json b/server/account-service/package.json
index effaaff2ffb..a018b17c7cc 100644
--- a/server/account-service/package.json
+++ b/server/account-service/package.json
@@ -32,6 +32,7 @@
     "@types/koa-router": "^7.4.8",
     "@types/koa": "^2.15.0",
     "@types/koa__cors": "^5.0.0",
+    "@types/cookies": "^0.9.0",
     "@typescript-eslint/parser": "^6.11.0",
     "eslint-config-standard-with-typescript": "^40.0.0",
     "prettier": "^3.1.0",
@@ -53,6 +54,7 @@
     "koa": "^2.15.3",
     "koa-router": "^12.0.1",
     "koa-bodyparser": "^4.4.1",
+    "cookies": "^0.9.1",
     "@koa/cors": "^5.0.0",
     "@hcengineering/server-token": "^0.6.11",
     "@hcengineering/analytics": "^0.6.0"
diff --git a/server/account-service/src/index.ts b/server/account-service/src/index.ts
index c5aa2c79f83..0e8f8041815 100644
--- a/server/account-service/src/index.ts
+++ b/server/account-service/src/index.ts
@@ -17,8 +17,9 @@ import { Analytics } from '@hcengineering/analytics'
 import { registerProviders } from '@hcengineering/auth-providers'
 import { metricsAggregate, type BrandingMap, type MeasureContext } from '@hcengineering/core'
 import platform, { Severity, Status, addStringsLoader, setMetadata } from '@hcengineering/platform'
-import serverToken, { decodeToken } from '@hcengineering/server-token'
+import serverToken, { decodeToken, decodeTokenVerbose, generateToken } from '@hcengineering/server-token'
 import cors from '@koa/cors'
+import type Cookies from 'cookies'
 import { type IncomingHttpHeaders } from 'http'
 import Koa from 'koa'
 import bodyParser from 'koa-bodyparser'
@@ -26,6 +27,8 @@ import Router from 'koa-router'
 import os from 'os'
 import { migrateFromOldAccounts } from './migration/migration'
 
+const AUTH_TOKEN_COOKIE = 'account-metadata-Token'
+
 /**
  * @public
  */
@@ -142,14 +145,60 @@ export function serveAccount (measureCtx: MeasureContext, brandings: BrandingMap
     )
   })
 
-  const extractToken = (header: IncomingHttpHeaders): string | undefined => {
+  const extractCookieToken = (headers: IncomingHttpHeaders): string | undefined => {
+    if (headers.cookie != null) {
+      const cookies = headers.cookie.split(';')
+      const tokenCookie = cookies.find((cookie) => cookie.includes(AUTH_TOKEN_COOKIE))
+      return tokenCookie?.split('=')[1]
+    }
+
+    return undefined
+  }
+
+  const extractAuthorizationToken = (headers: IncomingHttpHeaders): string | undefined => {
     try {
-      return header.authorization?.slice(7) ?? undefined
+      return headers.authorization?.slice(7) ?? undefined
     } catch {
       return undefined
     }
   }
 
+  const extractToken = (headers: IncomingHttpHeaders): string | undefined => {
+    return extractAuthorizationToken(headers) ?? extractCookieToken(headers)
+  }
+
+  function getCookieOptions (ctx: Koa.Context): Cookies.SetOption {
+    const requestUrl = ctx.request.href
+    const url = new URL(requestUrl)
+    const domain = getCookieDomain(requestUrl)
+
+    return {
+      httpOnly: true,
+      domain,
+      secure: url?.protocol === 'https',
+      maxAge: 1000 * 60 * 60 * 24 * 365 // 1 year
+    }
+  }
+
+  const getCookieDomain = (url: string): string => {
+    const hostname = new URL(url).hostname
+
+    if (hostname === 'localhost') {
+      return hostname
+    }
+
+    if (/^(\d{1,3}\.){3}\d{1,3}$/.test(hostname)) {
+      return hostname
+    }
+
+    const parts = hostname.split('.')
+    if (parts.length > 2) {
+      return '.' + parts.slice(-2).join('.')
+    }
+
+    return hostname
+  }
+
   router.get('/api/v1/statistics', (req, res) => {
     try {
       const token = req.query.token as string
@@ -176,6 +225,46 @@ export function serveAccount (measureCtx: MeasureContext, brandings: BrandingMap
     }
   })
 
+  router.put('/cookie', async (ctx) => {
+    const token = extractToken(ctx.request.headers)
+    if (token === undefined) {
+      ctx.body = JSON.stringify({
+        error: new Status(Severity.ERROR, platform.status.Unauthorized, {})
+      })
+      ctx.res.writeHead(401)
+      ctx.res.end()
+      return
+    }
+
+    // Ensure we don't set the token with workspace to the cookie
+    const { account, extra } = decodeTokenVerbose(measureCtx, token)
+    const tokenWithoutWorkspace = generateToken(account, undefined, extra)
+
+    const cookieOpts = getCookieOptions(ctx)
+
+    ctx.cookies.set(AUTH_TOKEN_COOKIE, tokenWithoutWorkspace, cookieOpts)
+    ctx.res.writeHead(204)
+    ctx.res.end()
+  })
+
+  router.delete('/cookie', async (ctx) => {
+    const token = extractToken(ctx.request.headers)
+    if (token === undefined) {
+      ctx.body = JSON.stringify({
+        error: new Status(Severity.ERROR, platform.status.Unauthorized, {})
+      })
+      ctx.res.writeHead(401)
+      ctx.res.end()
+      return
+    }
+
+    const cookieOpts = { ...getCookieOptions(ctx), maxAge: 0 }
+
+    ctx.cookies.set(AUTH_TOKEN_COOKIE, '', cookieOpts)
+    ctx.res.writeHead(201)
+    ctx.res.end()
+  })
+
   router.put('/api/v1/manage', async (req, res) => {
     try {
       const token = req.query.token as string
diff --git a/server/account/src/__tests__/utils.test.ts b/server/account/src/__tests__/utils.test.ts
index d45450301a7..0058e455a67 100644
--- a/server/account/src/__tests__/utils.test.ts
+++ b/server/account/src/__tests__/utils.test.ts
@@ -538,25 +538,27 @@ describe('account utils', () => {
       const mockResult = { data: 'test' }
       const mockMethod = jest.fn().mockResolvedValue(mockResult)
       const wrappedMethod = wrap(mockMethod)
-      const request = { id: 'req1', params: ['param1', 'param2'] }
+      const request = { id: 'req1', params: { param1: 'value1', param2: 'value2' } }
 
-      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request)
+      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request, 'token')
 
       expect(result).toEqual({ id: 'req1', result: mockResult })
-      expect(mockMethod).toHaveBeenCalledWith(mockCtx, mockDb, mockBranding, 'param1', 'param2')
+      expect(mockMethod).toHaveBeenCalledWith(mockCtx, mockDb, mockBranding, 'token', {
+        param1: 'value1',
+        param2: 'value2'
+      })
     })
 
     test('should handle token parameter', async () => {
       const mockResult = { data: 'test' }
       const mockMethod = jest.fn().mockResolvedValue(mockResult)
       const wrappedMethod = wrap(mockMethod)
-      const request = { id: 'req1', params: ['param1'] }
-      const token = 'test-token'
+      const request = { id: 'req1', params: { param1: 'value1' } }
 
-      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request, token)
+      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request, 'token')
 
       expect(result).toEqual({ id: 'req1', result: mockResult })
-      expect(mockMethod).toHaveBeenCalledWith(mockCtx, mockDb, mockBranding, token, 'param1')
+      expect(mockMethod).toHaveBeenCalledWith(mockCtx, mockDb, mockBranding, 'token', { param1: 'value1' })
     })
 
     test('should handle PlatformError', async () => {
@@ -565,7 +567,7 @@ describe('account utils', () => {
       const wrappedMethod = wrap(mockMethod)
       const request = { id: 'req1', params: [] }
 
-      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request)
+      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request, 'token')
 
       expect(result).toEqual({ error: errorStatus })
       expect(mockCtx.error).toHaveBeenCalledWith('error', { status: errorStatus })
@@ -576,7 +578,7 @@ describe('account utils', () => {
       const wrappedMethod = wrap(mockMethod)
       const request = { id: 'req1', params: [] }
 
-      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request)
+      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request, 'token')
 
       expect(result).toEqual({
         error: new Status(Severity.ERROR, platform.status.Unauthorized, {})
@@ -589,7 +591,7 @@ describe('account utils', () => {
       const wrappedMethod = wrap(mockMethod)
       const request = { id: 'req1', params: [] }
 
-      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request)
+      const result = await wrappedMethod(mockCtx, mockDb, mockBranding, request, 'token')
 
       expect(result.error.code).toBe(platform.status.InternalServerError)
       expect(mockCtx.error).toHaveBeenCalledWith('error', {
@@ -604,7 +606,7 @@ describe('account utils', () => {
       const wrappedMethod = wrap(mockMethod)
       const request = { id: 'req1', params: [] }
 
-      await wrappedMethod(mockCtx, mockDb, mockBranding, request)
+      await wrappedMethod(mockCtx, mockDb, mockBranding, request, 'token')
     })
   })
 
@@ -1080,7 +1082,10 @@ describe('account utils', () => {
       test('should handle guest access to existing workspace', async () => {
         ;(mockDb.workspace.findOne as jest.Mock).mockResolvedValue(mockWorkspace)
 
-        const result = await selectWorkspace(mockCtx, mockDb, mockBranding, guestToken, workspaceUrl, 'external')
+        const result = await selectWorkspace(mockCtx, mockDb, mockBranding, guestToken, {
+          workspaceUrl,
+          kind: 'external'
+        })
 
         expect(result).toEqual({
           account: GUEST_ACCOUNT,
@@ -1097,7 +1102,7 @@ describe('account utils', () => {
         ;(mockDb.workspace.findOne as jest.Mock).mockResolvedValue(null)
 
         await expect(
-          selectWorkspace(mockCtx, mockDb, mockBranding, guestToken, workspaceUrl, 'external')
+          selectWorkspace(mockCtx, mockDb, mockBranding, guestToken, { workspaceUrl, kind: 'external' })
         ).rejects.toThrow(
           new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUrl }))
         )
@@ -1127,7 +1132,10 @@ describe('account utils', () => {
       test('should handle system account access', async () => {
         ;(mockDb.workspace.findOne as jest.Mock).mockResolvedValue(mockWorkspace)
 
-        const result = await selectWorkspace(mockCtx, mockDb, mockBranding, systemToken, workspaceUrl, 'external')
+        const result = await selectWorkspace(mockCtx, mockDb, mockBranding, systemToken, {
+          workspaceUrl,
+          kind: 'external'
+        })
 
         expect(result).toEqual({
           account: systemAccountUuid,
@@ -1168,7 +1176,10 @@ describe('account utils', () => {
         ;(mockDb.workspaceStatus.findOne as jest.Mock).mockResolvedValue({ isDisabled: false })
         ;(mockDb.person.findOne as jest.Mock).mockResolvedValue(mockPerson)
 
-        const result = await selectWorkspace(mockCtx, mockDb, mockBranding, userToken, workspaceUrl, 'external')
+        const result = await selectWorkspace(mockCtx, mockDb, mockBranding, userToken, {
+          workspaceUrl,
+          kind: 'external'
+        })
 
         expect(result).toEqual({
           account: mockAccount.uuid,
@@ -1185,7 +1196,7 @@ describe('account utils', () => {
         ;(mockDb.account.findOne as jest.Mock).mockResolvedValue(null)
 
         await expect(
-          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, workspaceUrl, 'external')
+          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, { workspaceUrl, kind: 'external' })
         ).rejects.toThrow(new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotFound, {})))
       })
 
@@ -1194,7 +1205,7 @@ describe('account utils', () => {
         ;(mockDb.workspace.findOne as jest.Mock).mockResolvedValue(null)
 
         await expect(
-          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, workspaceUrl, 'external')
+          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, { workspaceUrl, kind: 'external' })
         ).rejects.toThrow(
           new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUrl }))
         )
@@ -1206,7 +1217,7 @@ describe('account utils', () => {
         ;(mockDb.getWorkspaceRole as jest.Mock).mockResolvedValue(null)
 
         await expect(
-          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, workspaceUrl, 'external')
+          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, { workspaceUrl, kind: 'external' })
         ).rejects.toThrow(new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {})))
 
         expect(mockCtx.error).toHaveBeenCalledWith('Not a member of the workspace being selected', expect.any(Object))
@@ -1219,7 +1230,7 @@ describe('account utils', () => {
         ;(mockDb.workspaceStatus.findOne as jest.Mock).mockResolvedValue({ isDisabled: true, mode: 'active' })
 
         await expect(
-          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, workspaceUrl, 'external')
+          selectWorkspace(mockCtx, mockDb, mockBranding, userToken, { workspaceUrl, kind: 'external' })
         ).rejects.toThrow(
           new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUrl }))
         )
diff --git a/server/account/src/operations.ts b/server/account/src/operations.ts
index 9c5c1f5455b..6018ad1363f 100644
--- a/server/account/src/operations.ts
+++ b/server/account/src/operations.ts
@@ -111,9 +111,13 @@ export async function login (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string,
-  password: string
+  token: string,
+  params: {
+    email: string
+    password: string
+  }
 ): Promise<LoginInfo> {
+  const { email, password } = params
   const normalizedEmail = cleanEmail(email)
 
   try {
@@ -163,8 +167,11 @@ export async function loginOtp (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string
+  token: string,
+  params: { email: string }
 ): Promise<OtpInfo> {
+  const { email } = params
+
   // Note: can support OTP based on any other social logins later
   const normalizedEmail = cleanEmail(email)
   const emailSocialId = await getEmailSocialId(db, normalizedEmail)
@@ -190,11 +197,15 @@ export async function signUp (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string,
-  password: string,
-  firstName: string,
-  lastName: string
+  token: string,
+  params: {
+    email: string
+    password: string
+    firstName: string
+    lastName: string
+  }
 ): Promise<LoginInfo> {
+  const { email, password, firstName, lastName } = params
   const account = await signUpByEmail(ctx, db, branding, email, password, firstName, lastName)
   const person = await db.person.findOne({ uuid: account })
   if (person == null) {
@@ -224,10 +235,14 @@ export async function signUpOtp (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string,
-  firstName: string,
-  lastName: string
+  token: string,
+  params: {
+    email: string
+    firstName: string
+    lastName: string
+  }
 ): Promise<OtpInfo> {
+  const { email, firstName, lastName } = params
   // Note: can support OTP based on any other social logins later
   const normalizedEmail = cleanEmail(email)
   let emailSocialId = await getEmailSocialId(db, normalizedEmail)
@@ -259,9 +274,14 @@ export async function validateOtp (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string,
-  code: string
+  token: string,
+  params: {
+    email: string
+    code: string
+  }
 ): Promise<LoginInfo> {
+  const { email, code } = params
+
   // Note: can support OTP based on any other social logins later
   const normalizedEmail = cleanEmail(email)
   const emailSocialId = await getEmailSocialId(db, normalizedEmail)
@@ -314,9 +334,12 @@ export async function createWorkspace (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  workspaceName: string,
-  region?: string
+  params: {
+    workspaceName: string
+    region?: string
+  }
 ): Promise<WorkspaceLoginInfo> {
+  const { workspaceName, region } = params
   const { account } = decodeTokenVerbose(ctx, token)
 
   ctx.info('Creating workspace record', { workspaceName, account, region })
@@ -356,11 +379,14 @@ export async function createInviteLink (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  exp: number,
-  emailMask: string,
-  limit: number,
-  role?: AccountRole
+  params: {
+    exp: number
+    emailMask: string
+    limit: number
+    role?: AccountRole
+  }
 ): Promise<string> {
+  const { exp, emailMask, limit, role } = params
   const { account, workspace: workspaceUuid } = decodeTokenVerbose(ctx, token)
 
   const currentAccount = await db.account.findOne({ uuid: account })
@@ -389,9 +415,12 @@ export async function sendInvite (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  email: string,
-  role: AccountRole
+  params: {
+    email: string
+    role: AccountRole
+  }
 ): Promise<void> {
+  const { email, role } = params
   const { account, workspace: workspaceUuid } = decodeTokenVerbose(ctx, token)
 
   const currentAccount = await db.account.findOne({ uuid: account })
@@ -406,7 +435,8 @@ export async function sendInvite (
 
   const expHours = 48
   const exp = expHours * 60 * 60 * 1000
-  const inviteId = await createInviteLink(ctx, db, branding, token, exp, email, 1, role)
+
+  const inviteId = await createInviteLink(ctx, db, branding, token, { exp, emailMask: email, limit: 1, role })
   const inviteEmail = await getInviteEmail(branding, email, inviteId, workspace, expHours)
 
   await sendEmail(inviteEmail)
@@ -442,7 +472,7 @@ export async function resendInvite (
     inviteId = invite.id
     await db.invite.updateOne({ id: invite.id }, { expiresOn: newExp, remainingUses: 1, role })
   } else {
-    inviteId = await createInviteLink(ctx, db, branding, token, newExp, email, 1, role)
+    inviteId = await createInviteLink(ctx, db, branding, token, { exp: newExp, emailMask: email, limit: 1, role })
   }
 
   const inviteEmail = await getInviteEmail(branding, email, inviteId, workspace, expHours, true)
@@ -464,10 +494,14 @@ export async function join (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string,
-  password: string,
-  inviteId: string
+  _token: string,
+  params: {
+    email: string
+    password: string
+    inviteId: string
+  }
 ): Promise<WorkspaceLoginInfo | LoginInfo> {
+  const { email, password, inviteId } = params
   const normalizedEmail = cleanEmail(email)
   const invite = await getWorkspaceInvite(db, inviteId)
   if (invite == null) {
@@ -483,7 +517,7 @@ export async function join (
 
   ctx.info('Joining a workspace using invite', { email, normalizedEmail, ...invite })
 
-  const { token, account } = await login(ctx, db, branding, normalizedEmail, password)
+  const { token, account } = await login(ctx, db, branding, _token, { email: normalizedEmail, password })
 
   if (token == null) {
     return {
@@ -503,8 +537,9 @@ export async function checkJoin (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  inviteId: string
+  params: { inviteId: string }
 ): Promise<WorkspaceLoginInfo> {
+  const { inviteId } = params
   const { account: accountUuid } = decodeTokenVerbose(ctx, token)
 
   const invite = await getWorkspaceInvite(db, inviteId)
@@ -526,7 +561,7 @@ export async function checkJoin (
     throw new PlatformError(new Status(Severity.ERROR, platform.status.WorkspaceNotFound, { workspaceUuid }))
   }
 
-  const wsLoginInfo = await selectWorkspace(ctx, db, branding, token, workspace.url, 'external')
+  const wsLoginInfo = await selectWorkspace(ctx, db, branding, token, { workspaceUrl: workspace.url, kind: 'external' })
 
   if (getRolePower(wsLoginInfo.role) < getRolePower(invite.role)) {
     await db.updateWorkspaceRole(accountUuid, workspaceUuid, invite.role)
@@ -545,12 +580,16 @@ export async function signUpJoin (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string,
-  password: string,
-  first: string,
-  last: string,
-  inviteId: string
+  token: string,
+  params: {
+    email: string
+    password: string
+    first: string
+    last: string
+    inviteId: string
+  }
 ): Promise<WorkspaceLoginInfo> {
+  const { email, password, first, last, inviteId } = params
   const normalizedEmail = cleanEmail(email)
   ctx.info('Signing up and joining a workspace using invite', { email, normalizedEmail, first, last, inviteId })
 
@@ -609,9 +648,12 @@ export async function changePassword (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  oldPassword: string,
-  password: string
+  params: {
+    oldPassword: string
+    newPassword: string
+  }
 ): Promise<void> {
+  const { oldPassword, newPassword } = params
   const { account: accountUuid } = decodeTokenVerbose(ctx, token)
 
   ctx.info('Changing password', { accountUuid })
@@ -626,7 +668,7 @@ export async function changePassword (
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
   }
 
-  await setPassword(ctx, db, branding, accountUuid, password)
+  await setPassword(ctx, db, branding, accountUuid, newPassword)
 
   ctx.info('Password changed', { accountUuid })
 }
@@ -635,8 +677,10 @@ export async function requestPasswordReset (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  email: string
+  _token: string,
+  params: { email: string }
 ): Promise<void> {
+  const { email } = params
   const normalizedEmail = cleanEmail(email)
 
   ctx.info('Requesting password reset', { email, normalizedEmail })
@@ -694,8 +738,10 @@ export async function restorePassword (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  password: string
+  params: { password: string }
 ): Promise<LoginInfo> {
+  const { password } = params
+
   const { account, extra } = decodeTokenVerbose(ctx, token)
   ctx.info('Restoring password', { account, extra })
 
@@ -720,7 +766,7 @@ export async function restorePassword (
     await db.socialId.updateOne({ key: emailSocialId.key }, { verifiedOn: Date.now() })
   }
 
-  return await login(ctx, db, branding, email, password)
+  return await login(ctx, db, branding, token, { email, password })
 }
 
 export async function leaveWorkspace (
@@ -728,12 +774,13 @@ export async function leaveWorkspace (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  targetAccount: PersonUuid
+  params: { account: PersonUuid }
 ): Promise<LoginInfo | null> {
+  const { account: targetAccount } = params
   const { account, workspace } = decodeTokenVerbose(ctx, token)
-  ctx.info('Removing account from workspace', { targetAccount, workspace })
+  ctx.info('Removing account from workspace', { account, workspace })
 
-  if (targetAccount == null || workspace == null) {
+  if (account == null || workspace == null) {
     ctx.error('Account or workspace not provided for leaving', { account, workspace })
     throw new PlatformError(new Status(Severity.ERROR, platform.status.InternalServerError, {}))
   }
@@ -775,9 +822,12 @@ export async function changeUsername (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  first: string,
-  last: string
+  params: {
+    first: string
+    last: string
+  }
 ): Promise<void> {
+  const { first, last } = params
   const { account } = decodeTokenVerbose(ctx, token)
 
   ctx.info('Changing name of person', { account, first, last })
@@ -792,8 +842,9 @@ export async function updateWorkspaceName (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  name: string
+  params: { name: string }
 ): Promise<void> {
+  const { name } = params
   const { account, workspace } = decodeTokenVerbose(ctx, token)
   const role = await db.getWorkspaceRole(account, workspace)
 
@@ -840,7 +891,8 @@ export async function deleteWorkspace (
 export async function getRegionInfo (
   ctx: MeasureContext,
   db: AccountDB,
-  branding: Branding | null
+  branding: Branding | null,
+  token: string
 ): Promise<RegionInfo[]> {
   return getRegions()
 }
@@ -863,8 +915,10 @@ export async function getWorkspaceInfo (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  updateLastVisit: boolean = false
+  params: { updateLastVisit: boolean }
 ): Promise<WorkspaceInfoWithStatus> {
+  const { updateLastVisit = false } = params
+
   const { account, workspace: workspaceUuid, extra } = decodeTokenVerbose(ctx, token)
   const isGuest = extra?.guest === 'true'
   const skipAssignmentCheck = isGuest || account === systemAccountUuid
@@ -903,9 +957,12 @@ export async function listWorkspaces (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  region?: string | null,
-  mode?: WorkspaceMode | null
+  params: {
+    region?: string | null
+    mode?: WorkspaceMode | null
+  }
 ): Promise<WorkspaceInfoWithStatus[]> {
+  const { region, mode } = params
   const { extra } = decodeTokenVerbose(ctx, token)
 
   if (!['tool', 'backup', 'admin'].includes(extra?.service) && extra?.admin !== 'true') {
@@ -920,10 +977,13 @@ export async function performWorkspaceOperation (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  workspaceId: WorkspaceUuid | WorkspaceUuid[],
-  event: 'archive' | 'migrate-to' | 'unarchive' | 'delete' | 'reset-attempts',
-  ...params: any
+  parameters: {
+    workspaceId: WorkspaceUuid | WorkspaceUuid[]
+    event: 'archive' | 'migrate-to' | 'unarchive' | 'delete' | 'reset-attempts'
+    params: any[]
+  }
 ): Promise<boolean> {
+  const { workspaceId, event, params } = parameters
   const { extra } = decodeTokenVerbose(ctx, token)
 
   if (extra?.admin !== 'true') {
@@ -1119,8 +1179,9 @@ export async function getSocialIds (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  confirmed: boolean = true
+  params: { confirmed: boolean }
 ): Promise<SocialId[]> {
+  const { confirmed = true } = params
   const { account } = decodeTokenVerbose(ctx, token)
 
   // do not expose not-confirmed social ids for now
@@ -1153,8 +1214,9 @@ export async function getPersonInfo (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  account: PersonUuid
+  params: { account: PersonUuid }
 ): Promise<PersonInfo> {
+  const { account } = params
   const { extra } = decodeTokenVerbose(ctx, token)
   verifyAllowedServices(['workspace', 'tool'], extra)
 
@@ -1178,8 +1240,9 @@ export async function findPerson (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  socialString: string
+  params: { socialString: string }
 ): Promise<PersonUuid | undefined> {
+  const { socialString } = params
   decodeTokenVerbose(ctx, token)
 
   const socialId = await db.socialId.findOne({ key: socialString as PersonId })
@@ -1217,9 +1280,12 @@ export async function updateWorkspaceRoleBySocialId (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  socialKey: string,
-  targetRole: AccountRole
+  params: {
+    socialKey: string
+    targetRole: AccountRole
+  }
 ): Promise<void> {
+  const { socialKey, targetRole } = params
   const { extra } = decodeTokenVerbose(ctx, token)
 
   if (!['workspace', 'tool'].includes(extra?.service)) {
@@ -1231,7 +1297,7 @@ export async function updateWorkspaceRoleBySocialId (
     throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotFound, {}))
   }
 
-  await updateWorkspaceRole(ctx, db, branding, token, socialId.personUuid, targetRole)
+  await updateWorkspaceRole(ctx, db, branding, token, { targetAccount: socialId.personUuid, targetRole })
 }
 
 export async function updateWorkspaceRole (
@@ -1239,9 +1305,13 @@ export async function updateWorkspaceRole (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  targetAccount: PersonUuid,
-  targetRole: AccountRole
+  params: {
+    targetAccount: PersonUuid
+    targetRole: AccountRole
+  }
 ): Promise<void> {
+  const { targetAccount, targetRole } = params
+
   const { account, workspace } = decodeTokenVerbose(ctx, token)
 
   if (workspace === null) {
@@ -1294,10 +1364,13 @@ export async function getPendingWorkspace (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  region: string, // A region requested
-  version: Data<Version>, // A workspace version requested, if it doesn't match for the region, workspace will be returned for upgrade
-  operation: WorkspaceOperation
+  params: {
+    region: string
+    version: Data<Version>
+    operation: WorkspaceOperation
+  }
 ): Promise<WorkspaceInfoWithStatus | undefined> {
+  const { region, version, operation } = params
   const { extra } = decodeTokenVerbose(ctx, token)
   if (extra?.service !== 'workspace') {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
@@ -1330,12 +1403,17 @@ export async function updateWorkspaceInfo (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  workspaceUuid: WorkspaceUuid,
-  event: WorkspaceEvent,
-  version: Data<Version>, // A worker version
-  progress: number,
-  message?: string
+  params: {
+    workspaceUuid: WorkspaceUuid
+    event: WorkspaceEvent
+    version: Data<Version> // A worker version
+    progress: number
+    message?: string
+  }
 ): Promise<void> {
+  const { workspaceUuid, event, version, message } = params
+  let progress = params.progress
+
   const { extra } = decodeTokenVerbose(ctx, token)
   if (!['workspace', 'tool'].includes(extra?.service)) {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
@@ -1460,10 +1538,13 @@ export async function workerHandshake (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  region: string, // A worker region
-  version: Data<Version>, // A worker version
-  operation: WorkspaceOperation
+  params: {
+    region: string
+    version: Data<Version>
+    operation: WorkspaceOperation
+  }
 ): Promise<void> {
+  const { region, version, operation } = params
   const { extra } = decodeTokenVerbose(ctx, token)
   if (extra?.service !== 'workspace') {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
@@ -1478,8 +1559,9 @@ export async function updateBackupInfo (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  backupInfo: BackupStatus
+  params: { backupInfo: BackupStatus }
 ): Promise<void> {
+  const { backupInfo } = params
   const { extra, workspace } = decodeTokenVerbose(ctx, token)
   if (extra?.service !== 'backup') {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
@@ -1504,10 +1586,13 @@ export async function assignWorkspace (
   db: AccountDB,
   branding: Branding | null,
   token: string,
-  email: string,
-  workspaceUuid: WorkspaceUuid,
-  role: AccountRole
+  params: {
+    email: string
+    workspaceUuid: WorkspaceUuid
+    role: AccountRole
+  }
 ): Promise<void> {
+  const { email, workspaceUuid, role } = params
   const { extra } = decodeTokenVerbose(ctx, token)
   if (!['aibot', 'tool', 'workspace'].includes(extra?.service)) {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
diff --git a/server/account/src/types.ts b/server/account/src/types.ts
index 65b284b8c06..23a61612067 100644
--- a/server/account/src/types.ts
+++ b/server/account/src/types.ts
@@ -203,7 +203,7 @@ export type AccountMethodHandler = (
   db: AccountDB,
   branding: Branding | null,
   request: any,
-  token?: string
+  token: string | undefined
 ) => Promise<any>
 
 export type WorkspaceEvent =
diff --git a/server/account/src/utils.ts b/server/account/src/utils.ts
index fac5a1026df..7b029e0f382 100644
--- a/server/account/src/utils.ts
+++ b/server/account/src/utils.ts
@@ -120,8 +120,7 @@ export function wrap (
     request: any,
     token?: string
   ): Promise<any> {
-    if (token !== undefined) request.params.unshift(token)
-    return await accountMethod(ctx, db, branding, ...request.params)
+    return await accountMethod(ctx, db, branding, token, { ...request.params })
       .then((result) => ({ id: request.id, result }))
       .catch((err) => {
         const status =
@@ -497,12 +496,15 @@ export async function selectWorkspace (
   ctx: MeasureContext,
   db: AccountDB,
   branding: Branding | null,
-  token: string,
-  workspaceUrl: string,
-  kind: 'external' | 'internal' | 'byregion',
-  externalRegions: string[] = []
+  token: string | undefined,
+  params: {
+    workspaceUrl: string
+    kind: 'external' | 'internal' | 'byregion'
+    externalRegions?: string[]
+  }
 ): Promise<WorkspaceLoginInfo> {
-  const { account: accountUuid, workspace: tokenWorkspaceUuid, extra } = decodeTokenVerbose(ctx, token)
+  const { workspaceUrl, kind, externalRegions = [] } = params
+  const { account: accountUuid, workspace: tokenWorkspaceUuid, extra } = decodeTokenVerbose(ctx, token ?? '')
   const getKind = (region: string | undefined): EndpointKind => {
     switch (kind) {
       case 'external':
@@ -949,7 +951,7 @@ export async function doJoinByInvite (
     await db.updateWorkspaceRole(account, workspace.uuid, invite.role)
   }
 
-  const result = await selectWorkspace(ctx, db, branding, token, workspace.url, 'external')
+  const result = await selectWorkspace(ctx, db, branding, token, { workspaceUrl: workspace.url, kind: 'external' })
 
   await useInvite(db, invite.id)
 
diff --git a/services/sign/pod-sign/debug/branding.json b/services/sign/pod-sign/debug/branding.json
index 0e7f1d64ac8..f9e1485061f 100644
--- a/services/sign/pod-sign/debug/branding.json
+++ b/services/sign/pod-sign/debug/branding.json
@@ -1,17 +1,17 @@
 {
-  "localhost:8080": {
+  "huly.local:8080": {
     "title": "Huly",
     "language": "en"
   },
-  "localhost:8087": {
+  "huly.local:8087": {
     "title": "Huly",
     "language": "en"
   },
-  "localhost:8081": {
+  "huly.local:8081": {
     "title": "TraceX",
     "language": "en"
   },
-  "localhost:8088": {
+  "huly.local:8088": {
     "title": "TraceX",
     "language": "en"
   }
diff --git a/tests/create-local.sh b/tests/create-local.sh
index 28ff04bfbd7..fd898340a06 100755
--- a/tests/create-local.sh
+++ b/tests/create-local.sh
@@ -1,8 +1,10 @@
-./tool-local.sh create-workspace sanity-ws
+#!/usr/bin/env bash
 
 ./tool-local.sh create-account user1 -f John -l Appleseed -p 1234
 ./tool-local.sh create-account user2 -f Kainin -l Dirak -p 1234
 
+./tool-local.sh create-workspace sanity-ws email:user1
+
 # Restore workspace contents in mongo/elastic
 ./tool-local.sh backup-restore ./sanity-ws sanity-ws
 
diff --git a/tests/sanity/tests/API/Api.ts b/tests/sanity/tests/API/Api.ts
index bfa4e168f83..ad565987d73 100644
--- a/tests/sanity/tests/API/Api.ts
+++ b/tests/sanity/tests/API/Api.ts
@@ -22,11 +22,11 @@ export class ApiEndpoint {
     return headers
   }
 
-  private async loginAndGetToken (username: string, password: string): Promise<string> {
+  private async loginAndGetToken (email: string, password: string): Promise<string> {
     const loginUrl = this.baseUrl
     const loginPayload = {
       method: 'login',
-      params: [username, password]
+      params: { email, password }
     }
     const headers = {
       'Content-Type': 'application/json',
@@ -54,30 +54,30 @@ export class ApiEndpoint {
     const url = this.baseUrl
     const payload = {
       method: 'createWorkspace',
-      params: [workspaceName]
+      params: { workspaceName }
     }
     const headers = this.getDefaultHeaders(token)
     const response = await this.request.post(url, { data: payload, headers })
     return (await response.json()).result
   }
 
-  async createAccount (username: string, password: string, firstName: string, lastName: string): Promise<any> {
+  async createAccount (email: string, password: string, firstName: string, lastName: string): Promise<any> {
     const url = this.baseUrl
     const payload = {
       method: 'signUp',
-      params: [username, password, firstName, lastName]
+      params: { email, password, firstName, lastName }
     }
     const headers = this.getDefaultHeaders()
     const response = await this.request.post(url, { data: payload, headers })
     return await response.json()
   }
 
-  async leaveWorkspace (email: string, username: string, password: string): Promise<any> {
+  async leaveWorkspace (account: string, username: string, password: string): Promise<any> {
     const token = await this.loginAndGetToken(username, password)
     const url = this.baseUrl
     const payload = {
       method: 'leaveWorkspace',
-      params: [email]
+      params: { account }
     }
     const headers = this.getDefaultHeaders(token)
     const response = await this.request.post(url, { data: payload, headers })
diff --git a/tests/sanity/tests/model/left-side-menu-page.ts b/tests/sanity/tests/model/left-side-menu-page.ts
index 762fa5d3afa..0d8c5c3ddc8 100644
--- a/tests/sanity/tests/model/left-side-menu-page.ts
+++ b/tests/sanity/tests/model/left-side-menu-page.ts
@@ -1,4 +1,4 @@
-import { type Locator, type Page, expect } from '@playwright/test'
+import { type Locator, type Page } from '@playwright/test'
 import { CommonPage } from './common-page'
 
 export class LeftSideMenuPage extends CommonPage {
@@ -70,29 +70,4 @@ export class LeftSideMenuPage extends CommonPage {
   async clickOnCloseInvite (): Promise<void> {
     await this.clickCloseOnInviteLinkButton().click()
   }
-
-  // Retrieve the last token from local storage
-  async getLastToken (): Promise<string> {
-    return await this.page.evaluate(() => localStorage.getItem('login:metadata:LastToken') ?? '')
-  }
-
-  // Set the last token in local storage on the same page
-  async setLastToken (lastToken: string): Promise<void> {
-    await this.page.evaluate((token) => {
-      localStorage.setItem('login:metadata:LastToken', token)
-    }, lastToken)
-  }
-
-  // Set the last token in local storage on any specified page
-  async setLastTokenOnPage (targetPage: Page, lastToken: string): Promise<void> {
-    await targetPage.evaluate((token) => {
-      localStorage.setItem('login:metadata:LastToken', token)
-    }, lastToken)
-  }
-
-  // Assert that the last token is not empty
-  async verifyLastTokenNotEmpty (): Promise<void> {
-    const lastToken = await this.getLastToken()
-    expect(lastToken).not.toEqual('')
-  }
 }
diff --git a/tests/sanity/tests/workspace/create.spec.ts b/tests/sanity/tests/workspace/create.spec.ts
index 7be0af4e7da..e3697fa72b0 100644
--- a/tests/sanity/tests/workspace/create.spec.ts
+++ b/tests/sanity/tests/workspace/create.spec.ts
@@ -1,6 +1,6 @@
 import { test } from '@playwright/test'
 import { LoginPage } from '../model/login-page'
-import { DefaultWorkspace, generateId, PlatformURI, PlatformUser } from '../utils'
+import { generateId } from '../utils'
 import { SelectWorkspacePage } from '../model/select-workspace-page'
 import { SignUpPage } from '../model/signup-page'
 import { SignUpData } from '../model/common-types'
@@ -198,35 +198,4 @@ test.describe('Workspace tests', () => {
       await page2.close()
     }
   })
-
-  test('Create workspace with LastToken in the localStorage', async ({ page, browser }) => {
-    await loginPage.goto()
-    await loginPage.login(PlatformUser, '1234')
-    await selectWorkspacePage.selectWorkspace(DefaultWorkspace)
-    await leftSideMenuPage.clickTracker()
-
-    // Get and check the last token
-    await leftSideMenuPage.verifyLastTokenNotEmpty()
-
-    await test.step('Check create workspace action', async () => {
-      const newWorkspaceName = `Some HULY #@$ WS - ${generateId(12)}`
-      const pageSecond = await browser.newPage()
-      try {
-        // Authenticate in new browser context
-        await pageSecond.goto(`${PlatformURI}/login/login`)
-        await leftSideMenuPage.setLastTokenOnPage(pageSecond, await leftSideMenuPage.getLastToken())
-        await pageSecond.goto(`${PlatformURI}/login/createWorkspace`)
-
-        // Create workspace in the second context
-        const selectWorkspacePageSecond = new SelectWorkspacePage(pageSecond)
-        await selectWorkspacePageSecond.createWorkspace(newWorkspaceName)
-
-        // Use the tracker in the second context
-        const leftSideMenuPageSecond = new LeftSideMenuPage(pageSecond)
-        await leftSideMenuPageSecond.clickTracker()
-      } finally {
-        await pageSecond.close()
-      }
-    })
-  })
 })
diff --git a/workers/transactor/wrangler.toml b/workers/transactor/wrangler.toml
index 73abae2a209..f8ca2a89193 100644
--- a/workers/transactor/wrangler.toml
+++ b/workers/transactor/wrangler.toml
@@ -84,7 +84,7 @@ new_classes = ["Transactor"]
 [[hyperdrive]]
 binding = "HYPERDRIVE"
 id = "1f713bb2ec1b464cb663983feca4c89e"
-localConnectionString = "postgresql://postgree:example@host.docker.internal:26257/defaultdb?sslmode=disable"
+localConnectionString = "postgresql://postgree:example@huly.local:26257/defaultdb?sslmode=disable"
 
 # Bind a KV Namespace. Use KV as persistent storage for small key-value pairs.
 # Docs: https://developers.cloudflare.com/workers/wrangler/configuration/#kv-namespaces
diff --git a/ws-tests/create-local.sh b/ws-tests/create-local.sh
index 01ffb0c0ff7..8e9fb854b80 100755
--- a/ws-tests/create-local.sh
+++ b/ws-tests/create-local.sh
@@ -1,4 +1,6 @@
-./tool-local.sh create-workspace sanity-ws
+#!/usr/bin/env bash
 
 ./tool-local.sh create-account user1 -f John -l Appleseed -p 1234
 ./tool-local.sh create-account user2 -f Kainin -l Dirak -p 1234
+
+./tool-local.sh create-workspace sanity-ws email:user1
diff --git a/ws-tests/sanity/tests/workspace/archive.spec.ts b/ws-tests/sanity/tests/workspace/archive.spec.ts
index 4bba86b81aa..11264f00dbb 100644
--- a/ws-tests/sanity/tests/workspace/archive.spec.ts
+++ b/ws-tests/sanity/tests/workspace/archive.spec.ts
@@ -65,6 +65,9 @@ test.describe('Workspace Archive tests', () => {
       const loginPage2 = new LoginPage(adminSecondPage.page)
       await loginPage2.goto()
       await loginPage2.login('admin', '1234')
+      await loginPage2.page.waitForURL((url) => {
+        return url.pathname.startsWith('/login/selectWorkspace') || url.pathname.startsWith('/workbench/')
+      })
 
       const adminPage = new AdminPage(page2)
       await adminPage.gotoAdmin()
diff --git a/ws-tests/sanity/tests/workspace/migrate.spec.ts b/ws-tests/sanity/tests/workspace/migrate.spec.ts
index 72b9640a8e4..d8b60adddba 100644
--- a/ws-tests/sanity/tests/workspace/migrate.spec.ts
+++ b/ws-tests/sanity/tests/workspace/migrate.spec.ts
@@ -61,10 +61,15 @@ test.describe('Workspace Migration tests', () => {
     const page2 = adminSecondPage.page
 
     await test.step('Migrate workspace', async () => {
+      const page = adminSecondPage.page
       // login as admin
       const loginPage2 = new LoginPage(adminSecondPage.page)
       await loginPage2.goto()
       await loginPage2.login('admin', '1234')
+      await page.waitForURL((url) => {
+        console.log(url.pathname)
+        return url.pathname.startsWith('/login/selectWorkspace') || url.pathname.startsWith('/workbench/')
+      })
 
       const adminPage = new AdminPage(page2)
       await adminPage.gotoAdmin()
diff --git a/ws-tests/tool-local.sh b/ws-tests/tool-local.sh
new file mode 100755
index 00000000000..699ccd9fd35
--- /dev/null
+++ b/ws-tests/tool-local.sh
@@ -0,0 +1,14 @@
+export MODEL_VERSION=$(node ../common/scripts/show_version.js)
+export MINIO_ACCESS_KEY=minioadmin
+export MINIO_SECRET_KEY=minioadmin
+export MINIO_ENDPOINT=localhost:9000
+export MONGO_URL=mongodb://localhost:27017
+export DB_URL=mongodb://localhost:27017
+export ACCOUNT_DB_URL=mongodb://localhost:27017
+export ACCOUNTS_URL=http://localhost:3000
+export TRANSACTOR_URL=ws://localhost:3333
+export ELASTIC_URL=http://localhost:9200
+export SERVER_SECRET=secret
+
+# Restore workspace contents in mongo/elastic
+node ../dev/tool/bundle/bundle.js $@
\ No newline at end of file