Dashboard account security

The Account security page

Open Account & organization › Account security. It has three cards: Two-factor authentication (with an On or Off badge), Passkeys and Active sessions. Passwords and email are handled on the sign-up, sign-in and recovery pages, covered in the next two sections.

Password

The server applies two rules whenever you open an account or set a new password:

• 10 to 128 characters. Anything shorter gets "Use at least 10 characters".
• Not a known breached password. ClavisAUH checks it against the Have I Been Pwned database using k-anonymity: only the first 5 characters of its SHA-1 hash leave the server, never the password itself. A match gets "This password has appeared in a data breach · choose another one".

The strength meter (Weak, Fair, Solid, Fortified) and the three hints 10+ characters, Upper and lower case and A number or symbol are advisory only; the server does not enforce them. A long random password from a password manager is still your best option.

Passwords are stored only as Argon2id hashes, never in readable form. To slow down guessing, the server accepts at most 5 password sign-ins per minute; past that, wait a minute and try again.

Resetting your password

The dashboard has no change-password form for a signed-in user yet. To change your password, use the recovery flow:

1. On the sign-in page, click Forgot password?.
2. Enter your email and click Send recovery code. The page always says "If an account exists for that email, a code is on its way", whether or not it does, so nobody can probe which emails are registered.
3. Enter the 6-digit code from the email (valid for 10 minutes) and your New password, then click Set new password.
4. Click Continue to sign in and sign in with the new password.

Email verification

You must verify your email before you can sign in with a password.

1. After you click Open your account, you land on "Your code is on its way". A 6-digit code goes to the address you entered and is valid for 10 minutes.
2. Type it into Verification code. The form submits on its own once all 6 digits are in, or click Verify.
3. Once verified, you are signed in and taken straight to the dashboard.

Good to know:

• Resend code unlocks after a 30-second countdown. After 5 wrong entries the current code is discarded and you need a new one.
• Typed the wrong address? Click Change email to go back to sign-up.
• If you try to sign in before verifying, ClavisAUH sends a fresh code and takes you to the verification page.
• The email shown on Account & organization › Profile is read-only. Changing your email is not supported in the dashboard yet.

Two-factor authentication (2FA)

2FA adds a step after your password: a 6-digit code from an authenticator app on your phone that changes every 30 seconds. Google Authenticator, Microsoft Authenticator, 1Password or any other TOTP app works. Someone who knows your password still cannot get in without your phone.

Turning on 2FA

1. Open Account & organization › Account security and click Enable on the Two-factor authentication card.
2. The dialog asks you to "Confirm your password". Enter your Password and click Confirm. A wrong password shows "That email and password don't match".
3. Scan the QR code with your authenticator app. If you cannot scan, use the key under Or enter this key manually (it has a copy button). The entry appears in your app as ClavisAUH with your email.
4. Open Backup codes and store the 10 codes in your password manager or print them. The copy button takes the whole list.
5. Enter the 6-digit code your app is showing. The dashboard checks it as soon as all 6 digits are in, says "Two-factor authentication is on" and the badge switches to On.

If you close the dialog before step 5, 2FA stays off. The next Enable creates a new key and a new set of backup codes, so delete the old entry from your authenticator app.

Turning on 2FA does not sign out your other devices. If you are turning it on because something looks wrong, also click Sign out other devices on the Active sessions card.

Signing in with 2FA

After you enter your email and password and click Enter your workspace, you reach Two-step verification, which has two tabs:

• Authenticator: enter the 6-digit code; it submits once complete.
• Backup code: enter one of your backup codes and click Verify. Codes are case-sensitive, so type them exactly as saved.

This step has limits to stop guessing:

• You have 10 minutes from entering your password. After that, sign in again from the start.
• Each sign-in attempt allows up to 5 wrong codes, then you must enter your password again.
• 10 wrong codes in a row, across attempts, lock the account's 2FA step for 15 minutes.

Codes keep failing even though you type them correctly? Check that your phone's clock syncs automatically, because TOTP codes are time-based.

Backup codes and a lost phone

Each backup code works exactly once. If you lose or replace your phone:

1. Sign in, pick the Backup code tab and enter one of your remaining codes.
2. Go to Account & organization › Account security, click Disable and then Enable again to link the new phone and get 10 fresh backup codes.

There is no separate button to regenerate backup codes; disabling and re-enabling is how you get a new set. If you have lost both your phone and your backup codes, click Contact support next to Lost your device? on the verification page.

Turning off 2FA

Click Disable, enter your password and click Confirm. The dashboard says "Two-factor authentication is off". Your TOTP key and all backup codes are deleted, and the browser you are using loses its trusted status.

Trusted devices

On the Two-step verification page, switch on Trust this device for 30 days before you verify. From then on, that browser only needs your email and password, with no 2FA code.

• Every time you sign in with your password on that browser within the window, the trust is renewed for another 30 days.
• Trust lives in a browser cookie, so a private window, a different browser or cleared cookies mean no trust.
• Signing out does not remove trust. Turning off 2FA only removes trust from the browser you are using.
• The dashboard has no list of trusted devices yet. If you lose a trusted machine, reset your password: every session is signed out, and that machine still needs the new password to get in.

Only trust personal machines, never shared ones.

Passkeys

A passkey lets you sign in with Touch ID, Windows Hello, a hardware security key or a password manager, without typing a password. Passkeys are bound to the dashboard's domain, so a lookalike phishing site cannot use them.

Adding a passkey

1. On the Passkeys card in Account & organization › Account security, click Add passkey.
2. Follow your browser or operating system prompt: fingerprint, face, PIN or a plugged-in security key.
3. The dashboard says "Passkey added" and the passkey appears in the list with the time it was added.

Adding a passkey is a sensitive action, so it only works within 15 minutes of signing in. If nothing happens when you click, sign out, sign back in and try again.

Signing in with and removing a passkey

On the sign-in page, click Sign in with a passkey at the top and choose your passkey. If you cancel, the page shows "Passkey sign-in was cancelled". Passkey sign-in does not ask for a 2FA code, because a passkey is already tied to your device and is usually unlocked with your fingerprint, face or PIN.

To remove one, click the trash icon on its row. It is deleted right away, with no confirmation.

Passkey only

Turn on Passkey only in Account & organization › Account security to switch password sign-in off for your account. It needs at least two passkeys.

There is no sign-in with a code sent by mail. The codes in your inbox only verify your email and reset a password.

Active sessions

The Active sessions card lists your live sessions. Each row shows the operating system (read from the browser's user agent), the IP address and when it was last active. The session you are using is labelled This device.

• Click Sign out on a row to end that session.
• Click Sign out other devices to end every session except the current one.

Both act immediately with no confirmation, and take effect on that device's very next request, because ClavisAUH does not cache sessions in cookies. A session lasts 7 days and is extended as you use the dashboard, at most once a day, so a session left unused for about 7 days expires on its own.

Actions that need a recent sign-in

Seller API keys, signing keys, webhooks and ownership transfer need a sign-in from the last 15 minutes in production. If yours is older, sign out, sign back in and try again.

Requiring 2FA or a passkey for the whole team

Team MFA Enforcement is an Advanced Protection method set per app, and it is off by default. When it is on, anyone in the workspace without 2FA or a passkey cannot work with that app in the dashboard, whatever their role, the Owner included.

Turning it on

1. Turn on 2FA or add a passkey on your own account first.
2. Open the app and go to App security › Protection, tab Methods.
3. If the app is in Standard Protection, click Use this mode on Advanced Protection.
4. In the Access Control group, switch on Team MFA Enforcement. The dashboard says "Saved".

Only Admins and Owners can change this method. If you have neither yet, the dashboard refuses with "Turn on 2FA for your own account first". New apps run Standard Protection, where this rule does not apply, so nobody is locked out on day one. Going back to Standard stops the rule, and it returns when Advanced is on again. Every change is recorded in Change history at the bottom of the page, with who made it and when.

While it is on

A member with neither still sees the app under Workspace › Apps, but the pages inside the app show "Something went wrong" with a Try again button. On the server side, the request is refused with HTTP 403:

{
  "error": {
    "code": "two_factor_required",
    "message": "This app requires two-factor authentication for every member",
    "requestId": "..."
  }
}

• As soon as that person turns on 2FA or adds a passkey under Account & organization › Account security, they are back in, without signing in again.
• The rule accepts a passkey as well as 2FA.
• The rule applies only to dashboard users. Your software, your end users and Seller API calls are not affected.

Related

• Workspaces, members and roles
• The two protection modes
• Selling with the Seller API