Security and two-factor
Console reference for personal sign-in credentials, step-up confirmation, and the workspace-wide two-factor requirement.
Path: Settings > Security
| Tab | Route | What it holds |
|---|---|---|
| Sign-in | /settings/security | Authenticator, passkeys, linked accounts |
| Recovery | /settings/security?tab=recovery | Recovery codes, recovery email |
| CLI sessions | /settings/security?tab=sessions | Terminals signed in with penv login |
| Workspace | /settings/security/workspace | The two-factor requirement and the enrollment roster |
Only an owner sets the workspace requirement.
Signing in
Once you enroll an authenticator app or a passkey, every sign-in asks for it: a password, a Google, GitHub or Microsoft click, and single sign-on all stop at Confirm it's you until you enter a code from your app, use a passkey, or enter a recovery code. Signing in with a passkey is both steps at once.
| Session rule | Value |
|---|---|
| Idle | We sign you out after 8 hours without a request |
| Longest | 7 days from sign-in |
| Adding a way in | Adding an authenticator, a passkey or a linked account asks for your current factor, or, if you have none, a sign-in from the last 10 minutes |
| After a change | Every change to your sign-in methods signs out your other sessions, and we email your sign-in address |
Step-up
We ask for step-up ("Confirm it is you") before a sensitive action: writing, deleting or revealing a value, removing someone, minting a machine credential, and the other actions each page's table marks. With a factor enrolled, you answer with it. Without one, you confirm your password, or sign in again if your account has no password.
Some actions need two-factor authentication and a fresh step-up: inviting a member, changing a member's role or granting one, creating or editing a role, exporting values (to a file or an integration), changing single sign-on or directory sync, and lowering a protection (turning off write-only, require approval or the two-factor requirement, stopping the audit stream). Without a factor, we refuse these and tell you to set one up first.
| Rule | Value |
|---|---|
| Freshness window | 15 minutes, with no repeat prompt inside it |
| You have no factor | Signing in counts for 15 minutes; after that we ask for your password |
| Needs two-factor | Refused until you enroll an authenticator or a passkey |
| Order | We check the permission first; without it we refuse you, not challenge you |
Personal credentials
| Card | Actions |
|---|---|
| Authenticator | Enroll a code-generating app, or replace the current one |
| Passkeys | Add, rename, remove. Each passkey signs in and answers step-up |
| Recovery codes | Regenerate the one-time codes. Shown once a factor exists |
| Recovery email | Add a second address, verify, remove, or promote it to the sign-in address |
| Terminals | Every terminal signed in to your account, each with a sign-out button |
| Sign out everywhere | Ends every other browser session and every terminal. This browser stays signed in |
| Linked accounts | Link or unlink Google, GitHub and Microsoft sign-in |
A terminal signed in with penv login lasts 30 days from last use, and never more than 90 days from sign-in. Signing it out here equals penv logout on that terminal. A password reset, a new sign-in address, replacing your authenticator, removing a passkey or linked account, and Sign out everywhere sign every terminal out too.
The recovery email removal link we send lasts 30 days and needs no session, so you can cut off an address its owner lost.
Workspace two-factor requirement
As an owner, you can require a second factor for every member.
| Stage | What happens |
|---|---|
| On | A grace window starts, with a deadline banner until everybody enrolls |
| After the deadline | We hold a member with no factor at /mfa until they add one. Their terminals cannot reach the workspace until they add one and run penv login again |
| Change the window | You can't edit it: turn the requirement off and on again |
Holders of member:read see how many members are enrolled and the roster: each member's factors (authenticator app, passkey) and status, members without a factor first.
Required permissions
Full matrix: Roles and permissions.
| Action | Requires | Step-up | Audit entry |
|---|---|---|---|
| Open the page | org:read | No | none |
| Enroll an authenticator | Signed-in session from the last 10 minutes | No | member.mfa_enrolled |
| Replace an authenticator | Signed-in session | Yes | member.mfa_enrolled |
| Add or remove a passkey | Signed-in session | Yes | not in the action filter |
| Rename a passkey | Signed-in session | No | not in the action filter |
| Regenerate recovery codes | Signed-in session | Yes | not in the action filter |
| Add, remove or promote a recovery email | Signed-in session | Yes | not in the action filter |
| Sign a terminal out | Signed-in session | Yes | device.revoked |
| Sign out everywhere | Signed-in session | Yes | device.revoked |
| Unlink a social account | Signed-in session | Yes | not in the action filter |
| See the enrollment roster | member:read | No | none |
| Turn the requirement on | Owner | Two-factor and fresh | org.mfa_required |
| Turn the requirement off | Owner | Two-factor and fresh | org.mfa_requirement_lifted |
Each answered challenge records member.step_up_verified, naming who confirmed and when.
Next: Encryption and BYOK.
Directory sync
Point an identity provider at penv over SCIM so it provisions and deprovisions members, and what a closed seat does to billing.
Alerts
Choose which members receive each alert by email, and post alerts to Slack, Microsoft Teams, Discord, Google Chat, PagerDuty, a signed webhook, SMS or WhatsApp.