Multi-Factor Authentication
Every dashboard login requires a second factor in addition to the password. By default the second factor is a one-time code sent by email — no setup is required beyond a verified email address. Users can optionally enrol TOTP (an authenticator app) and use that instead. This page covers the second factor, step-up verification, and account recovery.
Second Factor at Login
Out of the box, the second factor is a one-time code delivered by email. A user who prefers an authenticator app can enrol TOTP from Settings → Security:
Open Two-Factor Settings
Navigate to Settings → Security. The Two-Factor Authentication card shows the current status.
Set Up an Authenticator (optional)
Click Set up and follow the wizard: install an authenticator app, scan the QR code (or copy the secret manually), and verify with a 6-digit code. Once enrolled, TOTP becomes your second factor in place of the email code.
Reconfiguring
TOTP can be disabled and re-enrolled from the same screen. Changing two-factor settings is itself a protected operation — if the session isn’t fresh, the user is asked to re-authenticate first.
If a user loses access to their authenticator, account recovery runs through the email magic-link recovery flow, which signs the user in to reconfigure their credentials and revokes their other active sessions.
Step-Up Verification
Sensitive operations require fresh authentication even within an active session — an idle or hijacked session cannot perform high-risk actions:
- Recent-session requirement — security-sensitive settings (such as changing two-factor configuration) require a recently authenticated session; otherwise the dashboard prompts the user to re-authenticate.
- Mobile confirmation — governed operations such as adding a permanent whitelist address or creating, reordering and deleting a policy must be confirmed from the user’s enrolled mobile signer app, which signs the change. The dashboard shows a “confirm in mobile app” prompt and waits for the device’s confirmation. None of these operations can be performed without that signature.
This pairing means the dashboard session alone is never sufficient for operations that affect funds or governance — a registered device must participate.
Session Expiry
Dashboard sessions are short-lived, and sensitive settings additionally require a recently refreshed session. Session lifetimes are configured in the identity provider’s deployment configuration.