Everything below is included from the Business plan up unless marked otherwise. There is no separate module to license.
| Method | How the user completes it | Notes |
|---|---|---|
| TOTP | 6-digit code from an authenticator app, 30s window, one step of drift allowed | Default method. Works offline. |
| Push | App prompt with a number the user matches on screen | Requires the mobile app. Number matching avoids approval fatigue. |
| WebAuthn | Security key or platform authenticator, per device | Recommended for administrators and finance roles. |
| SMS | 6-digit code by text message | Opt-in only, off by default, disabled for admin roles. |
| Recovery codes | 10 single-use codes issued at enrolment | Generated once; not visible to administrators afterwards. |
The user receives an invitation naming your organisation and the group they belong to. The link is valid for seven days and can be reissued from the console.
The user scans a code, confirms a 6-digit test code, and names the device. If your policy allows it, the first device is approved automatically; otherwise an administrator approves it.
Added from inside the account after signing in with the first device. A new device always triggers a notice to the account owner.
Lost device: self-service recovery after a 10-minute delay, with an email notice to the account owner and an entry in the audit log. If that fails, an administrator override with a recorded reason.
Policies are written in the console, or applied through the API. A policy names the group and application it applies to and the method it requires:
Session lifetime runs from 1 hour to 12 hours. Break-glass accounts can be excluded by name, and their sign-ins are reported separately.
Bearer token authentication, 600 requests per minute per tenant, cursor pagination. A sandbox tenant and the OpenAPI description come with the trial account.
What we do not do: we do not store password hashes, we do not proxy your application traffic, and we do not require a client agent on user devices. Only the authentication step passes through us.