Multi-Factor Authentication
Every dashboard login requires a second factor in addition to the password. By default the second factor is a one-time code sent by email — no setup is required beyond a verified email address. Users can optionally enrol TOTP (an authenticator app) and use that instead. This page covers the second factor, step-up verification, and account recovery.
Second Factor at Login
Out of the box, the second factor is a one-time code delivered by email. A user who prefers an authenticator app can enrol TOTP from Settings → Security:
Open Two-Factor Settings
Navigate to Settings → Security. The Two-Factor Authentication card shows the current status.
Set Up an Authenticator (optional)
Click Set up and follow the wizard: install an authenticator app, scan the QR code (or copy the secret manually), and verify with a 6-digit code. Once enrolled, TOTP becomes your second factor in place of the email code.
Reconfiguring
TOTP can be disabled and re-enrolled from the same screen. Changing two-factor settings is itself a protected operation — if the session isn’t fresh, the user is asked to re-authenticate first.
If a user loses access to their authenticator, account recovery runs through the email magic-link recovery flow, which signs the user in to reconfigure their credentials and revokes their other active sessions.
Step-Up Verification
Sensitive operations require fresh authentication even within an active session — an idle or hijacked session cannot perform high-risk actions:
- Recent-session requirement — security-sensitive settings (such as changing two-factor configuration) require a recently authenticated session; otherwise the dashboard prompts the user to re-authenticate.
- Mobile confirmation — governed operations such as adding a whitelist address or creating a policy must be confirmed from the user’s enrolled mobile signer app, which signs the change. The dashboard shows a “confirm in mobile app” prompt and waits for the device’s confirmation.
This pairing means the dashboard session alone is never sufficient for operations that affect funds or governance — a registered device must participate.
Session Expiry
Dashboard sessions are short-lived, and sensitive settings additionally require a recently refreshed session. Session lifetimes are configured in the identity provider’s deployment configuration.