Sign-in and MFA

Choose how users sign in to your organization: passwords, passkeys, second factors and how long sessions last.

Users sign in on your organization's hosted page, such as https://acme.fobauth.com/sign-in, with any of their verified email addresses. If your company has its own identity provider, they can sign in through it instead. See Enterprise SSO.

Permission

Needs Change sign-in, branding, domains and keys.

Set up sign-in

1. Open Security > Authenticators.
2. Under Methods, choose whether users can use passkeys and authenticator apps. Both are on by default.
3. Under Multi-factor, choose Required if everyone must have a second factor.
4. Under Passwords, review the password policy. The defaults suit most teams.
5. On Security > Session settings, change Sign in again after if users should sign in more often than every 14 days.

To ask for more on specific apps, such as a passkey for admin tools, use sign-on policies.

Second factors

Multi-factor policy	What happens
Off	Users sign in with a password only.
Optional (default)	Users can add a second factor, and are asked for it once they have one.
Required	Everyone needs one. Users without one set it up at their next sign-in.

Users can choose from these second factors:

Method	Notes
Passkey	A fingerprint, face or device PIN. A passkey on its own counts as MFA.
Authenticator app	Any TOTP app. One per user.
Recovery codes	Ten single-use codes, shown once when the user sets up their first second factor.

After entering their password, users have 10 minutes and five tries to enter their second factor.

A sign-on policy can require a second factor or a passkey for one app, whatever the Multi-factor policy says. When an app requires a passkey, users without one are asked to add one.

To check in your own app that a user signed in with MFA, look for mfa in the amr claim. See Scopes and claims.

A user lost their phone

Open the user's page in the console and choose Reset multi-factor. This removes their authenticator app, passkeys and recovery codes, and signs them out everywhere. They set up a new second factor at their next sign-in.

Passkeys

Passkeys are on by default. Users add, rename and remove them on their account page. To turn them off, go to Security > Authenticators.

Passkeys keep working if you add a custom domain. See Domains.

Sessions

Set these on Security > Session settings:

Setting	Default	Range
Sign in again after	14 days	8 hours to 90 days. Applies to new sessions.
Sign out after inactivity	Never	15 minutes to 1 day

Users see and end their sessions on their account page. Admins can end them on the user's page, or on Logs > Live sessions. Ending a session also revokes the refresh tokens apps got from it, so those apps can't get new tokens for the user.

Password policy

Option	Default	Range
Minimum length	12	8 to 128 characters
Require a lowercase letter, an uppercase letter, a number, a symbol	Off
Same character in a row, at most	Any	0 (any) to 10
No name or email address	Off
No breached passwords	On
Earlier passwords that can't be reused	None	0 to 24
Time between changes	No limit	Up to 7 days
Passwords expire after	Never	Up to 999 days
Ask for a new one	7 days before	0 to 30 days before expiry
Wrong passwords before locking	10	0 (never) to 100
Locked for	15 minutes	1 to 1,440 minutes

When a password is refused, the error lists every rule it breaks.

No breached passwords checks new passwords against Have I Been Pwned. Only the first five characters of the password's hash leave Fob. If the service doesn't respond within 3 seconds, Fob accepts the password.

If a user's password has expired or no longer meets the policy, Fob asks for a new one at their next sign-in. In the warning period before it expires, they can choose to change it later.

Lockout

After too many wrong attempts in a row, the account locks for the time set in Locked for, and the user gets an email. Wrong passwords, wrong second-factor codes and failed tries at confirming it's you all count.

The lock lifts when the time runs out, when the user resets their password, or when an admin chooses Unlock now on the user's page.

A locked account responds to a wrong password like any other account. This means an attacker can't use lockout to find out which emails have accounts.

Confirm it's you

Before a sensitive action, Fob asks a signed-in user to prove it's still them. This means a session left open on a shared computer can't be used to take over the account or reach a server.

Fob asks before a user:

• adds or removes a passkey or authenticator app, or creates new recovery codes
• changes their email address or deletes their account
• opens a terminal in the browser

Fob doesn't ask if the user signed in, or last confirmed, in the past 10 minutes. Otherwise a Confirm it's you dialog asks for:

The user has	They confirm with
A passkey	The passkey
A password	The password, plus their second factor if they have one
Neither (they sign in through an identity provider)	A fresh sign-in at the identity provider

Users whose identity provider is required always confirm there. If the provider doesn't report when it signed them in (auth_time for OpenID Connect, AuthnInstant for SAML), the user has to sign out and back in instead.

An admin impersonating a user can't confirm, so can't take these actions.

Related

• Emails Fob sends and how long their links last
• Rate limits on sign-in pages