---
title: Sign-in and security
description: Protect your own sign-in with a passkey or an authenticator app, set the organization's sign-in rules, and connect SSO and SCIM.
url: https://salexhub.com/docs/control/sign-in-security
type: how-to
area: control
section: Members and access
last_updated: 2026-11-14
prerequisites:
  - https://salexhub.com/docs/control/roles
related:
  - https://salexhub.com/docs/control/audit-log
  - https://salexhub.com/docs/developers/api-keys
tools: []
who: "Everyone, for their own sign-in. The organization's rules: Owners and Admins, or a role with Sign-in and API keys."
---

# Sign-in and security

Protect your own sign-in with a passkey or an authenticator app, set the organization's sign-in rules, and connect SSO and SCIM.

> **Who can do this**: Everyone, for their own sign-in. The organization's rules: Owners and Admins, or a role with Sign-in and API keys.

Each person protects their own sign-in. The organization can require a second factor, shorten sessions, and sign people in through its identity provider.

## Turn on two-factor authentication

In **Settings > Account > Sign-in and security**, under **Two-factor authentication**:

### Add a second factor

Choose **Add a passkey** and confirm with your fingerprint, face, PIN or security key. Or choose **Set up authenticator app**, scan the QR code, enter the 6-digit code and **Turn on**.

### Save your recovery codes

You get ten codes, shown only once. Each signs you in once if you lose your passkey or app. **Copy codes** or **Download**, tick **I saved these codes**, then **Done**.

Your other sessions are signed out. A passkey also signs you in on its own: **Sign in with a passkey** on the sign-in page. At the second step you can tick **Remember this browser for 30 days**.

**Create new codes** replaces the old ones. Removing your last factor stops your recovery codes.

## Your password and sessions

On the same page:

- **Change password**: at least 15 characters, or 8 once you have a second factor. Your other sessions are signed out.
- **Sessions** lists where you are signed in. **Sign out** ends one; **Sign out of other sign-ins** ends the rest.

## If you lose your second factor

Use a recovery code at the second step. With none left, choose **Help signing in**:

1. A link goes to your email. Open it within an hour and pick the organization whose admins you ask.
2. An admin finds your request in **Settings > Members and access > Members**, under **Requests for help signing in**, checks it is really you, and chooses **Agree to remove their second factors**.
3. You get a link for 24 hours. Opening it, with your password, removes your second factors and signs you out everywhere.

Your other organizations then ask to let you back in. Their admins choose **Let them back in**.

## Set the organization's rules

In **Settings > Members and access > Security**:

| Setting | Choices |
| --- | --- |
| **Ask for a second factor from** | **Nobody** (default), **Admins** or **Everyone**. Members it newly covers get 14 days and an email to add one |
| **Confirm it is them after** | 8 hours, 24 hours, 7 days, 14 days, or 30 days (default) |
| **Or after inactivity of** | 15, 30, 60 or 120 minutes, 8 hours, or no limit (default) |
| **Ask for a new password every** | Never (default), or 30 to 365 days |

To require a second factor, add one to your own account first. **Members without a second factor** lists who still has none.

![The organization's sign-in rules](/docs/screens/control/security-light.png "Settings > Members and access > Security.")

## Confirm it is you

Acts that change who can sign in, take data out or move money ask you to **Confirm it is you**: with your password, a passkey, an authenticator code, a recovery code or your identity provider. You are not asked again for two hours.

## SSO and provisioning

In **Settings > Members and access > SSO & Provisioning**. SSO is on Business and Enterprise; SCIM is on Enterprise.

### Verify a domain

**Add domain**, publish the TXT record at your DNS provider, then **Verify**.

### Connect your identity provider

Register the redirect URI shown at your provider, then enter its **Issuer**, **Client ID** and **Client secret**. Only OpenID Connect is supported. Turn on **Sign in through the identity provider** and save.

### Turn on SCIM

**Enable SCIM**, copy the **SCIM base URL**, then **Generate token**. The token is shown once. Your directory then adds, updates and turns off the people of your verified domains.

People then choose **Sign in with SSO**. External users sign in the way their own organization requires.

---

The same page for people: https://salexhub.com/docs/control/sign-in-security. Index of this site for agents: https://salexhub.com/llms.txt