> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# Direct Executions — your customer answers the second factor, and the product is granted per application

### INFONITE's widget, for a run you started

A direct execution started with `base_configurations.customer_interaction_available: true` now answers with a **`widget_url`** — from [Initiate with parameters](https://infonite.dev/direct-executions/api-reference/direct-executions-api/starting-executions/direct-executions-v-1-init-parametrized) and [Initiate with a token](https://infonite.dev/direct-executions/api-reference/direct-executions-api/starting-executions/direct-executions-v-1-init-tokenized) alike. Open it for your customer — a redirect, a new tab or, once your site's origin is enabled, an iframe of your page ([Opening it](/direct-executions/challenges#opening-it)) — and **INFONITE's widget takes care of them for that one run**, in your application's colours: its progress, the code or confirmation the institution asks for, how it ended, and the way back to the `completion_url` you set. Nothing to build. Or keep your own screens: the run is still yours to follow, answer with [Answer and resume](https://infonite.dev/direct-executions/api-reference/direct-executions-api/handling-the-state/direct-executions-v-1-handler-resume), read and delete. Inside an iframe it tells your page how it ended, with a `direct-execution:ended` message. [Challenges & MFA](/direct-executions/challenges#handing-the-pause-to-your-customer) explains it.

It fits Financial Rider's recurring access too: when your customer refreshes a tokenized connection from your app and the bank asks for a second factor again, they answer it in the widget, with no new session — [Refreshing with your customer present](/flows/financial-rider/recurring-access#refreshing-with-your-customer-present). In production a refresh is a direct execution, so it needs `product:direct_executions` as well as `login:tokenized_access` (below).

### A way back you add to the widget's URL

Append `completion_url` — and, if you like, `completion_mode` — to a `widget_url` and the widget's final screen takes your customer there, in this tab, a new one or behind a button. It works for direct executions and for any Financial Rider or Spain Public Administration session created without a way back of its own (the session's always wins), and only to an address under one of your application's redirect URLs, checked when the widget reaches its final screen. [Redirects & Completion](/flows/financial-rider/redirects#a-way-back-on-the-widgets-url) explains it.

### Renew or take back your customer's link

A direct execution's `session_token` — the one inside its `widget_url` — can now be replaced or revoked from your backend: [Issue a session token](https://infonite.dev/direct-executions/api-reference/direct-executions-api/handling-the-state/direct-executions-v-1-handler-issue-session-token) answers a new token and link, and the old link opens nothing from that moment; [Revoke the session token](https://infonite.dev/direct-executions/api-reference/direct-executions-api/handling-the-state/direct-executions-v-1-handler-revoke-session-token) leaves no link that opens the execution. The execution itself is untouched either way. [Your customer's session token](/direct-executions/authentication#your-customers-session-token) explains how long it lasts and what it opens.

### Renew or take back a flow session's widget link

The same, for Financial Rider and Spain Public Administration: a session's widget token can be replaced — [Issue a Session Token](https://infonite.dev/flows/financial-rider/api-reference/financial-rider-api/sessions-management/flows-financial-rider-v-1-session-token-issue) answers a new token and `widget_url`, and the old link opens nothing from that moment — or revoked, from your backend with your application secret. A session's token lives as long as the session, never shorter for not being used; deleting the session leaves it for the person still on its last screen — revoke it, before or after the deletion, when a link must stop working.

### Production runs need Direct Executions

Direct Executions is a product your application holds, like the flows. A **production** run now needs the capability `product:direct_executions`; without it both ways in answer `403` with `insufficient_capabilities@product:direct_executions` and nothing is created. A sandbox run never needs it. [Capabilities](/console/capabilities) says how to have it granted.