Security under SECURITY in the Settings drawer is self-service account hardening. Every signed-in user can enable two-factor authentication (TOTP) and manage passkeys without admin involvement. Workspace-wide policies — roles, member invites, module access — still require settings.view and are documented separately.
Please note:
- 2FA and passkeys protect your login. They do not replace role-based access inside the app — see Roles, permissions, and RBAC.
- Store backup codes or a second factor before traveling. Disabling 2FA requires confirmation and removes the extra login step immediately.
- OAuth sign-in via Google or Slack is configured separately under Linked accounts.
Two-factor authentication (TOTP)
Authenticator apps (Google Authenticator, Authy, 1Password, etc.) generate the 6-digit codes EDGE Sword asks for at sign-in after setup.
| Step | Action |
|---|---|
| 1 | Click Enable Two-Factor Authentication |
| 2 | Scan the QR code (or copy the manual secret) |
| 3 | Enter the 6-digit code and click Verify and Enable |
| Disable | Disable Two-Factor Authentication with confirmation |
Status shows Enabled or Disabled at the top of the card. Cancel during setup discards the pending secret until you start again.
Passkeys (WebAuthn)
Passkeys let you sign in with Face ID, Touch ID, Windows Hello, or a hardware security key instead of a password.
| Item | Detail |
|---|---|
| Add passkey | Registers this device or a synced platform passkey |
| Registered list | Name, device type (synced vs device-only), date added |
| Remove | Deletes that credential; login with it stops working |
| Browser support | Requires WebAuthn (modern Chrome, Safari, Edge, Firefox) |
Add at least one passkey on each device you use regularly. Synced passkeys (for example via iCloud Keychain or Google Password Manager) can work across devices tied to the same account.
flowchart TB
Login[Sign-in page] --> Method{Auth method}
Method --> Password[Email and password]
Method --> Passkey[Passkey WebAuthn]
Method --> OAuth[Google or Slack if linked]
Password --> TOTP{2FA enabled?}
TOTP -->|Yes| Code[6-digit TOTP code]
TOTP -->|No| App[Workspace access]
Code --> App
Passkey --> App
Admin vs personal security
| Topic | Where to manage | Permission |
|---|---|---|
| Your 2FA and passkeys | Settings → Security | None (self-service) |
| Member invites and offboarding | Settings → Members | settings.view |
| Role and permission design | Settings → Roles & Permissions | settings.view |
| Quarterly access review | Workspace security checklist | settings.view |
Encourage all users to enable 2FA or passkeys. Administrators should still run the Workspace security checklist for tenant-wide hygiene — limiting admin roles, disabling unused modules, and revoking ex-employee access via Manage members.
For linking Google or Slack sign-in (separate from passkeys), see Linked accounts (Google and Slack). Profile and device alerts are managed under Profile and push notifications.