Sign-in security: MFA and passkeys
This content is not available in your language yet.
Your TebibHost account can spend your organization’s money and delete its servers. Add a second factor: it stops anyone who learns your password. All of this lives under Your account → Sign-in security.
Passkeys
Section titled “Passkeys”A passkey signs you in with your device’s fingerprint, face or PIN (or a security key), and can’t be phished. You can register several (laptop, phone, a hardware key) and name each one.
- Sign-in security → Passkeys → Add a passkey.
- Follow your browser’s prompt.
- Next time, choose to sign in with a passkey.
Authenticator app (TOTP)
Section titled “Authenticator app (TOTP)”Any TOTP app works (for example Aegis, Google Authenticator, 1Password).
- Sign-in security → Authenticator app, and start the setup.
- Scan the QR code with the app.
- Enter the six-digit code from the app to turn it on.
After this, signing in with a password asks for a code.
Recovery codes
Section titled “Recovery codes”Recovery codes let you in if you lose your phone or passkeys. Each works once. Generate them in Sign-in security → Recovery codes, and keep them somewhere safe and offline. Generating new codes makes the old ones stop working.
Sessions
Section titled “Sessions”Your account → Sessions lists where you’re signed in. Sign out a single session, or sign out everywhere else if you think someone else has access.
MFA in policies
Section titled “MFA in policies”Console sessions that passed a second factor or a passkey carry auth:mfa = true, which policies
and guardrails can require. Access keys never do: protect them with
expiry and source networks instead. See Access keys and the CLI.
Password
Section titled “Password”Change it in Your account → Change password. Forgot it? Use Forgot password on the sign-in page to get a reset link by email.