DocsOrganizations
Two-factor & sessions
Protect INFRO accounts with an authenticator app, recovery codes and passkeys, see and end signed-in sessions, and require two-factor for a whole organization.
INFRO is in private early access. Running these examples requires an early-access account, an active trial or subscription entitlement, and your own provider connection. Self-serve purchasing is not generally open. See Early access.
An INFRO account can reach an organization's provider connections, routes, budgets and gateway keys, so it is worth more than a password. Every account can add a second step to its sign-in, and an owner or admin can require it for the whole organization. All of it is on every plan.
Methods
| Method | What it is | Used for |
|---|---|---|
| Authenticator app | A six-digit code that changes every 30 seconds, from 1Password, Google Authenticator, Microsoft Authenticator, Authy or any TOTP app. | The second step after your password. Turning it on is what turns two-factor on. |
| Recovery codes | Ten one-time codes, shown once when you turn two-factor on or create new ones. | The second step when your authenticator is not at hand. Each works once. |
| Passkey or security key | Touch ID, Face ID, Windows Hello, a passkey in your phone or password manager, or a hardware key such as a YubiKey. | Signing in without a password, or the second step after one. |
INFRO does not send codes by email or SMS. Your mailbox is where password resets go, so a password plus an emailed code is one factor twice, and SMS codes can be intercepted by moving your phone number.
Turn on two-factor
- Open Account settings in the console and find Two-factor authentication.
- Choose Set up two-factor authentication and enter your password.
- Scan the QR code with your authenticator app, or type the setup key into it.
- Enter the six-digit code the app shows, then save your ten recovery codes (copy or download them).
Turning two-factor on signs out every other session of your account. Sessions from before it existed never proved a second factor, so they do not survive it.
From then on, signing in with your password asks for a code, a recovery code, or your passkey or security key. There is no remember this device: every password sign-in asks. Ten wrong codes in a row lock two-factor for 15 minutes.
Passkeys and security keys
Add one under Account settings → Passkeys and security keys. Your browser offers to save it on the device, in your password manager, or on a hardware key. You can register several and name each one.
- Sign in with a passkey on the sign-in screen, or pick it from the email field's autofill. This needs no password, and no code afterwards, because the device verifies you with a PIN or biometric. A key that cannot verify you (a hardware key with no PIN set) is refused for this.
- As the second step: after your password, choose Use a passkey or security key. Here the key only has to be present, so any registered key works.
Confirm it's you
Changing how you sign in (turning two-factor off, creating new recovery codes, adding or removing a passkey) needs a confirmation from the last 10 minutes. The console asks only when it is needed, and one confirmation covers every change for those ten minutes.
With two-factor on, you confirm with a code, a recovery code or a passkey. Your password alone is not enough, so somebody holding an open browser and your password still cannot remove your second factor. Without two-factor, your password or a passkey confirms. An account with neither (for example, one that only signs in with Google) is asked to sign in again.
Sessions
Account settings → Where you're signed in lists every browser signed in to your account: browser and operating system, approximate location and IP address, how it signed in (for example Password + authenticator app, Passkey, Google) and when it was last active. Sign out ends one session; Sign out of all other sessions ends everything except the browser you are using. If you see one you do not recognise, end it and change your password.
Require two-factor for your organization
Owners and admins can turn on Require two-factor authentication under Settings → General. You need two-factor on your own account first.
- Members without two-factor are emailed when you turn it on. Until they set it up, the console shows them the setup screen and nothing else in this organization.
- Members who sign in through your organization's single sign-on satisfy it: your identity provider enforces its own MFA.
- API keys and management tokens are not affected. They are machine credentials, and your traffic keeps flowing.
- To replace an authenticator app (a new phone, say), a member turns two-factor off and sets it up again under Account settings. In between, the organization shows them only the setup screen.
- Settings → Members shows owners and admins who has two-factor on. Turning the policy on or off is recorded in the audit log.
Google, GitHub and single sign-on
Signing in with Google, GitHub or your organization's SSO does not ask for INFRO's second factor. Those providers run their own sign-in protection, so turn on two-step verification with them too. For an organization that requires two-factor, only an SSO sign-in counts on its own. A member who signs in with Google or GitHub still needs two-factor turned on for their INFRO account.
Lost your authenticator?
- Use a recovery code on the sign-in screen (Use a recovery code instead).
- Or use a passkey or security key. A synced passkey usually survives a lost phone.
- Or, from any browser that is still signed in, turn two-factor off or set up a new authenticator.
- If none of those is possible, contact support from your account's email address. We verify who you are before turning two-factor off, which includes confirmation from your organization's owner or an admin and a waiting period. This protects you from someone pretending to be you. We will email your account's address when it is done.