Two-factor and passkeys

A second factor is one more step after your password, so that a stolen password is not enough on its own. It can be a code from an authenticator app, a code sent by email, or a security key you plug in or tap. A passkey is something else. It replaces the password with your fingerprint, face or device PIN, and it works only where the organization allows it.

All of these belong to you, the way your password does, not to an organization. Set one up once and it counts in every organization you are a member of. An organization decides whether it requires a second factor and whether it accepts passkeys; which second factor you use is your choice.

Your security settings are on your own member page. Select your name at the foot of the navigation rail and choose Profile Settings, or open People → Members and select yourself. The Password, Sign-in and Two-factor tabs appear only on your own page, and only you can change what is on them. The one thing an administrator can do is clear your authenticator app and emailed codes when you have lost them, as described below.

Turning a method off, or removing a key or a passkey, asks for your password first, so a browser that someone left signed in is not enough to weaken your account. These settings also need you to be signed in yourself: an access token cannot change them.

Under Email code, choose Turn on. There is nothing to scan and no code to confirm: from your next sign-in, a code is sent to the address you sign in with. It expires after five minutes, and Send a new code on the sign-in screen sends another.

Emailed codes need a verified address. If yours is not verified yet, the tab says so and offers Send verification email. Follow the link in that message, then turn emailed codes on again.

A passkey signs you in with your fingerprint, face or device PIN instead of your password. It works only when your organization allows it; until then the Passkeys card on the Sign-in tab reads Passkeys are turned off.

To add one, choose Add a passkey on that card, give it a name such as the device it is on, choose Register passkey and confirm on your device. At your next sign-in, choose Sign in with a passkey. The button sits under the password field, and the first sign-in screen offers it straight away for an address this browser knows holds a passkey.

Your password keeps working beside it. Register a passkey on your phone as well as your laptop, and losing one device is not a lockout. Where the organization requires two-factor, a passkey replaces only the password, and you are still asked for a second factor.

On the Sign-in tab, Connected sign-in providers lets you sign in with Google as well as with your password. Choose Connect, sign in to Google, and you come back to this tab. Only a Google account on the same email address as your SXAccess account can be connected, and until it is, Continue with Google is refused for an address that already has an SXAccess account. Disconnect removes the link again.

To change your password, open the Password tab, enter your Current password and the new one twice, and choose Update password. The form lists the rules a new password has to meet and ticks them off as you type. An account created through Google has no password to change here.

The same rules apply in the dashboard and in the browser sign-in that the apps and the CLI open.

Owners and admins set two rules under Settings → Authentication. Each card there has its own Save changes button.

• Require it to enter this organization, on the Two-factor authentication card. Nobody works in the organization without a second factor, including people who sign in with Google. Members who have none are asked to set one up at their next sign-in and are offered the setup there and then, so nobody is locked out. Someone who belongs to several organizations is asked when they switch to this one. Any of the three second factors counts.
• Allow signing in with a passkey, on the Passwordless sign-in card, off by default. Once it is on, members register passkeys on their own Sign-in tab. Turning it off again stops passkeys from signing anyone in; registered ones stay listed so that their owners can remove them, and passwords keep working throughout.

Weigh one trade-off before you allow passkeys: the sign-in page then offers a passkey to every address, so someone outside your organization can learn that an address in it holds one. They cannot learn whether the address exists, and they cannot sign in without the device itself.

There are no recovery codes. A member who has lost one method but still has another signs in with that one: Verify it is you lists every method they set up, and Use another method goes back to that list. They then turn off or remove the lost method on their own Two-factor tab, and nobody else has to act.

When a member has lost the phone that holds their authenticator app and has no other method, an owner or admin opens People → Members, opens the menu on that member's row and chooses Reset two-factor. Check who you are talking to first: until the member sets up a new factor, their password is all that protects the account.

The reset removes the member's authenticator app and emailed codes. It cannot remove a security key or a passkey: if the account holds either, the reset stops with an error (Code 412), and whatever it removed before stopping stays removed. In that case the member, or an owner or admin for them, writes to support@sxaccess.com. Where the organization requires two-factor, the member is asked to set up a new factor at their next sign-in. You cannot reset your own two-factor this way; turn methods off on your own page instead. Every reset that removes something is recorded in Activity.

An organization that requires two-factor also asks for it when you switch to it.

• Dashboard and apps. If you switch to one in the dashboard, or switch to or join one in an app, and your sign-in did not include a second factor, you see Confirm it is you. You stay signed in: the screen only adds a second factor to the sign-in you already have.
• CLI. The CLI agent has no such screen, so set up a second factor in the dashboard before you use the CLI with such an organization; its browser sign-in then asks for it.

On Confirm it is you:

• Give a code from your authenticator app, an emailed code (Email me a code), or choose Use your security key.
• If you have none of them yet, set one up on the same screen.
• Back to where I was, or Cancel on an iPhone, takes you back to the organization you came from, and the organization asks again next time.

What answers the security key step depends on the device: