Two-factor authentication and passkeys

Turn on two-factor authentication for your own account, require it for everyone on the team, and add passkeys so you can sign in with a fingerprint, face, or device PIN. Everything on this page lives at Settings → Security (https://app.truto.one/settings/security).

Who can change what

Every team member sees Settings → Security and manages their own two-factor authentication, backup codes, and passkeys there.

Only team admins see the Team security card at the top of the page. It holds the two team-wide settings: Allow impersonation and Require two-factor authentication for all team members. If a member sends either setting to the API, Truto ignores it.

Turn on two-factor authentication for your account

Truto's second factor is a TOTP authenticator app, such as Google Authenticator, Authy, or 1Password. Codes are 6 digits.

1. Open Settings → Security.
2. In the Two-factor authentication card, click Enable two-factor authentication.
3. Scan the QR code with your authenticator app. If you can't scan it, click Can't scan? Enter key manually and type the key into the app.
4. Enter the 6-digit code under Enter the 6-digit code to verify and click Verify and enable.
5. Save the backup codes Truto shows you, then click Done. Use Download to save them as truto-backup-codes.txt, or the copy button to copy them.

The card now shows an Enabled badge. Truto emails you whenever two-factor authentication is turned on for your account.

From then on, signing in with a password, a login link, or Google, GitHub, or Microsoft takes you to a Two-factor authentication page. Enter the 6-digit code from your authenticator app and click Verify.

Require two-factor authentication for the team

1. As a team admin, open Settings → Security.
2. In Team security, check Require two-factor authentication for all team members.
3. Click Save changes.

New teams start with this setting turned on.

When it is on, any member without an authenticator app is sent to Set up two-factor authentication the next time they sign in with a password, a login link, or Google, GitHub, or Microsoft. They scan the QR code, enter a code, and click Verify and enable. Then they save their backup codes, check I have saved these backup codes, and click Continue.

While the requirement is on, members can't turn off their own two-factor authentication. The Disable two-factor authentication link is hidden.

Some sign-ins skip the code prompt because the identity check already happened somewhere else:

• Passkey sign-ins. The passkey verifies you on the device.
• Enterprise single sign-on. Your identity provider verifies you. See Single sign-on.

Sign in with a backup code

You get eight single-use backup codes, each shaped like xxxx-xxxx. They let you sign in when your authenticator app isn't available.

1. On the Two-factor authentication page, click Use a backup code instead.
2. Enter one code under Backup code and click Verify.

Each code works once. Settings → Security → Backup codes shows how many you have left, for example "6 of 8 backup codes remaining".

Regenerate backup codes

1. In Settings → Security, under Backup codes, click Regenerate backup codes.
2. Confirm with Regenerate.

All of your old codes stop working, and eight new ones appear under New backup codes. They are shown only once, so download or copy them before you leave the page.

Change your authenticator app

1. Under Authenticator app, click Change authenticator app.
2. Scan the new QR code with the new app.
3. Enter a code under Enter the 6-digit code from your new app and click Verify and switch.

Changing the app also replaces your backup codes, and the new set appears on the page. Truto emails you about the change.

Turn off two-factor authentication

Click Disable two-factor authentication, then Disable. This removes your authenticator app and your backup codes. The link is hidden while your team requires two-factor authentication.

Add a passkey

A passkey lets you sign in with your fingerprint, face, or device PIN instead of a password or login link. Signing in with a passkey doesn't ask for your authenticator code.

1. In the Passkeys card, click Add passkey.
2. Prove it's you. If you have two-factor authentication, enter a code from your authenticator app. If you don't, but you have a password, enter your password.
3. Follow your browser's or device's prompt to create the passkey.
4. In Name this passkey, give it a name such as MacBook Touch ID and click Save, or click Skip.

Truto emails you when a named passkey is added to your account. If you didn't add it, remove it straight away.

You can have up to 20 passkeys. Each one appears in a table with Name, Added, Last used, and Sync columns. Use the edit button to rename a passkey.

If your browser doesn't support passkeys, the card says so. You can still remove passkeys you added elsewhere.

Sign in with a passkey

On the Sign in to Truto page, click Sign in with a passkey and pick the passkey your device offers. There's no email or password to type.

Remove a passkey

Click the delete button on the passkey's row, then confirm Delete passkey? with Delete. That passkey stops working right away.

Allow Truto support to impersonate users

Allow impersonation lets Truto's support team sign in as users on your team to investigate a problem. Everything the support team does is logged and audited. It is on for new teams.

To turn it off, uncheck Allow impersonation in Team security and click Save changes. Truto support can no longer impersonate anyone on the team.

A support session can't add or remove passkeys. API calls made during one are labelled Called by Truto staff in the logs.

Next

If your organization has an identity provider, set up single sign-on to manage sign-in centrally. Use SCIM to provision and remove members from the identity provider.