Account security
Passkeys, two-step verification with an authenticator app, recovery codes, passwords, sessions, connected apps, and when FurniOps asks you to confirm it is you.
Your sign-in methods belong to your account, not to an organisation, and are managed on your
account pages at FurniOps sign-in (auth.furniops.com/account). In the dashboard,
Settings › Security links there. No API key or OAuth token can change them.
Sign-in methods
| Method | What it is |
|---|---|
| Passkey | Your fingerprint, face or screen lock instead of a password. Phishing-resistant, and a complete two-step sign-in on its own. |
| Single sign-on | Your organisation's identity provider, when it has connected one. |
| Email and password | With an authenticator app as a second step, if you turn one on. |
The sign-in page offers them in that order.
Passkeys
Under Security › Passkeys, Add a passkey registers one from your device or password manager. You can hold up to 20, rename them, and remove them. Each shows whether it is synced across your devices (a password manager or platform keychain) or bound to one device, when it was added and when it was last used.
Two-step verification
Under Authenticator app, Set up shows a QR code (or a key to type, or a link that opens your authenticator app). Enter the 6-digit code the app shows to turn it on. From then on, signing in with a password asks for a current code too. Codes change every 30 seconds and each works once.
Turning it off asks for a current code or a recovery code; your account is then protected by your password alone.
Recovery codes
Turning on the authenticator app gives you 10 recovery codes. Each works once, in place of a code from the app, if you lose it. They are shown once: save them in a password manager. Generate new codes replaces them all (the old ones stop working) and asks for a current code. The page shows how many are unused.
Passwords
- At least 15 characters, or at least 8 once a second factor (an authenticator app) is on; at most 256. No rules about symbols or case: a few unrelated words make a strong password.
- Passwords found in known breaches, and common or guessable ones, are refused.
- Change password signs out every other browser signed in to your account; this one stays signed in.
- Repeated wrong passwords lock the account for a while, for longer the more there are.
Sessions
Sessions lists every browser signed in to your account: when it signed in, when it was last active, from where, and whether it used two-step or a passkey. Sign out ends one; Sign out of all other sessions ends the rest.
- A session ends after 7 days without use, and after 30 days in any case.
- You can be signed in on up to 20 browsers; a new sign-in beyond that ends the one used least recently.
- Ending a session also ends the dashboard's sign-in in that browser.
Connected apps
Connected apps lists the apps that can access your account (OAuth apps you consented to), the organisation each acts in, and what each may do. Remove access stops its tokens in every organisation at once; it will have to ask for permission again. Resetting your password also ends every app's access.
Confirm it is you
Sensitive changes need a sign-in within the last 10 minutes: adding or removing a passkey, setting up two-step verification, changing your password, and, in the dashboard, making or rotating API keys, changing access policies, managing OAuth apps and changing single sign-on. If yours is older, FurniOps asks you to confirm it is you (with your password and code, a recovery code, a passkey, or your identity provider) and returns you to what you were doing.
Single sign-on
Let members sign in with your identity provider over OpenID Connect or SAML 2.0. Verify your domains, connect and test the provider, turn it on, and require it.
Support access
How FurniOps support can see what one of your members sees, the limits on it, how every access is recorded in your audit log, and how an organisation blocks it.