---
title: "Authentication"
description: "Require two-factor sign-in for console users, accept passkeys, remember trusted devices, and use emergency sign-in and new recovery codes."
url: "https://support.outpostplatform.com/depot/authentication/"
product: "depot"
type: "how-to"
status: "reviewed"
last_reviewed: 2026-10-19
ai_summary: "Settings > Authentication: require a second factor for everyone or owners only, with a 0 to 90 day enrollment deadline; accept TOTP, passkeys, and recovery codes; allow passwordless passkey sign-in; let trusted devices skip the second factor. Also adding a passkey, owner emergency sign-in past access rules (TOTP plus recovery code, one hour), and new recovery codes."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "client:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/authentication.md"
license: "CC BY 4.0"
---

# Authentication

**Settings** > **Authentication** decides whether console users must use a
second factor when they sign in, which factors count, and whether a trusted
device can skip the second factor. This page also covers passkeys, an
emergency sign-in for owners locked out by their own access rules, and a way to
replace your recovery codes.

## Before you begin

- You need the `client:manage` permission to change these settings. Anyone with
  `client:read` can view them.
- Turn on two-factor authentication for your own account first. See
  [Manage your console account](/depot/account-security/).
- The settings on this page and on
  [Security policy (preview)](/depot/security-policy-preview/) are one policy.
  A framework chosen there sets the requirement here and locks it.
- Saving a requirement that reaches more people, or removing an accepted
  factor, signs everyone out, including you. See
  [What a stricter policy does](/depot/security-policy-preview/#what-a-stricter-policy-does).

## Require a second factor

1. Go to **Settings** > **Authentication**.
2. On the **Requirement** card, in **Second factor is**, choose:

   | Option | Who must use a second factor |
   | --- | --- |
   | **Optional. Each person chooses.** | Nobody. This is the default. |
   | **Required for everyone.** | Every console user. |
   | **Required for owners only.** | People with the owner role. |

   When a framework other than **Custom** is chosen on the **Security policy**
   page, this list is locked and says **Set by** the framework **on the Security
   policy tab. Choose Custom there to change it.**

3. In **Enrollment deadline (days)**, enter how long people have to set up a
   second factor, from 0 to 90. The default is 14.
4. Select **Save**, then **Save and sign everyone out** to confirm.

After the save, the card shows **Enforced from** and the date the deadline
ends. The deadline starts when the requirement first reaches someone. Editing
the number of days later moves the date without restarting it.

:::danger
With a deadline of 0, anyone without a second factor, including you, is locked
out of the console the moment you save. The page warns before you save.
:::

### What people see

- **Before the deadline**, a person without a second factor sees **Your
  organization requires two-factor authentication.** at the top of every page,
  with a **Set it up before** link to the date. The link opens **Account**.
- **After the deadline**, signing in opens **Set up two-factor**, with **Your
  organization requires two-factor authentication. Set it up to continue.**
  The person selects **Set up two-factor**, scans the QR code with an
  authenticator app, enters the code, and saves the recovery codes shown. When
  passkeys are accepted, the same screen offers adding a passkey instead. The
  console opens once a factor is set up.

## Choose the accepted factors

On the **Accepted factors** card:

| Factor | What it is |
| --- | --- |
| **Authenticator app (TOTP)** | Six digit codes from an authenticator app. |
| **Passkey (WebAuthn)** | A passkey on the person's device or a hardware key. It is bound to your console's address, which makes it resistant to phishing. |
| **Allow signing in with a passkey alone** | Shown under passkeys. The sign-in page offers **Sign in with a passkey**, which replaces both the password and the second factor. The device must confirm the person with a PIN, fingerprint, or face. Access rules, lockouts, and password expiry still apply. |
| **Recovery codes** | Ten single-use codes issued when a second factor is turned on. A fallback, not a factor on its own. |

At least one of **Authenticator app (TOTP)** and **Passkey (WebAuthn)** must
be accepted. Passwordless sign-in needs passkeys to be accepted. Without
recovery codes, a person who loses their phone needs an owner to reset their
second factor, and [emergency sign-in](#emergency-sign-in-for-owners) is not
available.

All three factors are accepted by default. Passwordless sign-in is off by
default.

## Remember trusted devices

On the **Session behavior** card, turn on **Let people skip the second factor
on a trusted device**, and in **Remember a device for (days)** enter 1 to 90.
The default is 30.

At the second-factor step, people then see **Do not ask again on this device
for** the number of days. A remembered device weakens the second factor to
whatever protects that device, and frameworks that require a second factor at
every sign-in generally forbid it.

## Add a passkey to your account

When passkeys are accepted, each person adds their own:

1. Open the profile menu in the header and select **Account**.
2. On the **Passkeys** card, enter a name in **Name (optional)**, such as the
   device it is on.
3. Select **Add a passkey**. If the console asks you to confirm it is you,
   enter your **Current password** or an **Authenticator code**, then select
   **Continue**.
4. Follow your browser's prompts to create the passkey.

At sign-in, select **Use your passkey** at the second-factor step, or **Sign in
with a passkey** when passwordless sign-in is allowed. A passkey works only on
the console address it was created on. On the **Team** page, an owner can
remove a person's passkey, which signs that person out.

## Emergency sign-in for owners

[Access rules](/depot/access-rules/) can block sign-in by network and by hour,
and they can be changed only from inside the console. Emergency sign-in lets
an owner who is blocked by them get back in to fix them. It needs all of these:

- The owner role.
- An authenticator app turned on for the account, and at least one unused
  recovery code.
- **Recovery codes** accepted on the **Accepted factors** card.

To use it:

1. Sign in with your email address and password as usual. When the access
   rules block you, select **Use a recovery code to bypass sign-in
   restrictions**.
2. On **Emergency sign-in**, enter the **Authentication code** from your app
   and one **Recovery code**.
3. Select **Sign in**.

The session lasts one hour. The recovery code is used up. Every owner,
including you, is emailed, and the sign-in is recorded in the
[audit log](/depot/audit-log/). Every page shows **You signed in with an
emergency bypass of the sign-in restrictions.**, the time the session ends, and
**Review the access rules.**

Emergency sign-in bypasses only the network and hour rules. It does not get
past a disabled account, a lockout, or the second factor. It is refused with
**You are not restricted right now. Sign in normally.** when the rules do not
block you, so a recovery code is never spent by mistake, and with **Emergency
access is not available for this account.** when the account does not meet
the conditions above.

## Get new recovery codes

Replace your recovery codes when they run low or when you think someone else
has seen them.

1. Open the profile menu and select **Account**.
2. On the **Two-factor authentication** card, select **Get new recovery
   codes**.
3. In **Enter a current code to get new recovery codes**, enter a code from
   your authenticator app.
4. Select **Get new recovery codes**.
5. Save the new codes somewhere safe. They are shown once only.

Your old codes stop working as soon as the new ones are issued, and the card
says **Your old recovery codes no longer work.** The card counts the codes you
have left, such as **7 of 10 recovery codes left.**, and shows **Running low**
at 3 or fewer.

## Verify

- **Settings** > **Authentication** shows **Saved.**, and **Enforced from**
  when a second factor is required.
- Sign in as a test user without a second factor after the deadline. The
  console opens **Set up two-factor**.

## Related

- [Security policy (preview)](/depot/security-policy-preview/)
- [Manage your console account](/depot/account-security/)
- [Access rules](/depot/access-rules/)