Account Security
Kitbase supports three second factors, all managed under Account Settings → Security.
| Factor | What it proves | Notes |
|---|---|---|
| Authenticator app (TOTP) | Something you have | Six-digit codes from Google Authenticator, 1Password, Authy, … |
| Passkey | Something you have + something you are | Touch ID, Windows Hello, or a hardware security key. Phishing-resistant: a passkey will not sign you in on a look-alike domain |
| Backup codes | A one-time escape hatch | Ten single-use codes, issued when you enable TOTP |
Backup codes are exactly single-use. Once a code is spent it cannot be spent again, including by a second attempt made at the same moment — so a code someone else has seen is worth nothing once you have used it. Regenerating codes invalidates every previous one.
Signing in with a passkey
A passkey can sign you in on its own, with no password, provided your device actually verified you — a fingerprint, a face, or a device PIN. That is already two factors: possession of the device plus proof you are its owner.
If your device does not verify you (an unlocked security key with no PIN, for example), the assertion proves possession and nothing more. Kitbase treats that as a single factor:
- If you have an authenticator app enrolled, you are asked for a code before the sign-in completes.
- Otherwise you are signed in, but the session counts as single-factor for the rule below.
Organizations that require 2FA
An organization owner can require two-factor authentication for everyone in the organization, under Organization Settings → Security.
The requirement is checked against your current session, not against your account. This is the part worth understanding, because it explains both of the surprising cases:
- Enrolling an authenticator app is not enough on its own. If you then sign in with only a password, that session used one factor and the organization refuses it — you will see
ORG_007on every page. Sign in again and complete the second step. - You do not need an authenticator app if you use a passkey. A passkey sign-in that verified you already satisfies the requirement, so passkey-only members are not forced to also enrol TOTP.
The same rule follows a session wherever it goes. Refreshing keeps whatever factor the original sign-in used — it neither loses nor gains one — and a CLI session inherits the strength of the browser session that approved it, so approve CLI logins from a session that used your second factor.
Turning the requirement on
Members already signed in are not kicked out the moment you enable it. Their existing sessions continue until they expire, and every sign-in after that must satisfy the requirement.
Disabling two-factor authentication
Removing your authenticator app needs your password and a current code (or a backup code). If any organization you belong to requires 2FA, Kitbase refuses and names the organizations, so you know why.
Next steps
- CLI authentication — how a terminal session is authorised
- MCP connections — granting an AI assistant scoped access