Authentication

Settings > Authentication decides whether console users must use a second factor when they sign in, which factors count, and whether a trusted device can skip the second factor. This page also covers passkeys, an emergency sign-in for owners locked out by their own access rules, and a way to replace your recovery codes.

Before you begin

• You need the client:manage permission to change these settings. Anyone with client:read can view them.
• Turn on two-factor authentication for your own account first. See Manage your console account.
• The settings on this page and on Security policy (preview) are one policy. A framework chosen there sets the requirement here and locks it.
• Saving a requirement that reaches more people, or removing an accepted factor, signs everyone out, including you. See What a stricter policy does.

Require a second factor

1. Go to Settings > Authentication.

2. On the Requirement card, in Second factor is, choose:

   Option	Who must use a second factor
   Optional. Each person chooses.	Nobody. This is the default.
   Required for everyone.	Every console user.
   Required for owners only.	People with the owner role.

   When a framework other than Custom is chosen on the Security policy page, this list is locked and says Set by the framework on the Security policy tab. Choose Custom there to change it.

3. In Enrollment deadline (days), enter how long people have to set up a second factor, from 0 to 90. The default is 14.

4. Select Save, then Save and sign everyone out to confirm.

After the save, the card shows Enforced from and the date the deadline ends. The deadline starts when the requirement first reaches someone. Editing the number of days later moves the date without restarting it.

Danger

With a deadline of 0, anyone without a second factor, including you, is locked out of the console the moment you save. The page warns before you save.

What people see

• Before the deadline, a person without a second factor sees Your organization requires two-factor authentication. at the top of every page, with a Set it up before link to the date. The link opens Account.
• After the deadline, signing in opens Set up two-factor, with Your organization requires two-factor authentication. Set it up to continue. The person selects Set up two-factor, scans the QR code with an authenticator app, enters the code, and saves the recovery codes shown. When passkeys are accepted, the same screen offers adding a passkey instead. The console opens once a factor is set up.

Choose the accepted factors

On the Accepted factors card:

Factor	What it is
Authenticator app (TOTP)	Six digit codes from an authenticator app.
Passkey (WebAuthn)	A passkey on the person’s device or a hardware key. It is bound to your console’s address, which makes it resistant to phishing.
Allow signing in with a passkey alone	Shown under passkeys. The sign-in page offers Sign in with a passkey, which replaces both the password and the second factor. The device must confirm the person with a PIN, fingerprint, or face. Access rules, lockouts, and password expiry still apply.
Recovery codes	Ten single-use codes issued when a second factor is turned on. A fallback, not a factor on its own.

At least one of Authenticator app (TOTP) and Passkey (WebAuthn) must be accepted. Passwordless sign-in needs passkeys to be accepted. Without recovery codes, a person who loses their phone needs an owner to reset their second factor, and emergency sign-in is not available.

All three factors are accepted by default. Passwordless sign-in is off by default.

Remember trusted devices

On the Session behavior card, turn on Let people skip the second factor on a trusted device, and in Remember a device for (days) enter 1 to 90. The default is 30.

At the second-factor step, people then see Do not ask again on this device for the number of days. A remembered device weakens the second factor to whatever protects that device, and frameworks that require a second factor at every sign-in generally forbid it.

Add a passkey to your account

When passkeys are accepted, each person adds their own:

1. Open the profile menu in the header and select Account.
2. On the Passkeys card, enter a name in Name (optional), such as the device it is on.
3. Select Add a passkey. If the console asks you to confirm it is you, enter your Current password or an Authenticator code, then select Continue.
4. Follow your browser’s prompts to create the passkey.

At sign-in, select Use your passkey at the second-factor step, or Sign in with a passkey when passwordless sign-in is allowed. A passkey works only on the console address it was created on. On the Team page, an owner can remove a person’s passkey, which signs that person out.

Emergency sign-in for owners

Access rules can block sign-in by network and by hour, and they can be changed only from inside the console. Emergency sign-in lets an owner who is blocked by them get back in to fix them. It needs all of these:

• The owner role.
• An authenticator app turned on for the account, and at least one unused recovery code.
• Recovery codes accepted on the Accepted factors card.

To use it:

1. Sign in with your email address and password as usual. When the access rules block you, select Use a recovery code to bypass sign-in restrictions.
2. On Emergency sign-in, enter the Authentication code from your app and one Recovery code.
3. Select Sign in.

The session lasts one hour. The recovery code is used up. Every owner, including you, is emailed, and the sign-in is recorded in the audit log. Every page shows You signed in with an emergency bypass of the sign-in restrictions., the time the session ends, and Review the access rules.

Emergency sign-in bypasses only the network and hour rules. It does not get past a disabled account, a lockout, or the second factor. It is refused with You are not restricted right now. Sign in normally. when the rules do not block you, so a recovery code is never spent by mistake, and with Emergency access is not available for this account. when the account does not meet the conditions above.

Get new recovery codes

Replace your recovery codes when they run low or when you think someone else has seen them.

1. Open the profile menu and select Account.
2. On the Two-factor authentication card, select Get new recovery codes.
3. In Enter a current code to get new recovery codes, enter a code from your authenticator app.
4. Select Get new recovery codes.
5. Save the new codes somewhere safe. They are shown once only.

Your old codes stop working as soon as the new ones are issued, and the card says Your old recovery codes no longer work. The card counts the codes you have left, such as 7 of 10 recovery codes left., and shows Running low at 3 or fewer.

Verify

• Settings > Authentication shows Saved., and Enforced from when a second factor is required.
• Sign in as a test user without a second factor after the deadline. The console opens Set up two-factor.

Related

• Security policy (preview)
• Manage your console account
• Access rules