Security policies

Password and username rules, lockout, e-mail confirmation, new-address approval, network restrictions and suspensions — what each does and where to set it.

An account signs in to every client of its realm with the same credentials, so the rules about those credentials — usernames, passwords and lockout — are set once per realm. Who may enter a particular app, and from which networks, is set per client. Decisions about one person, such as approving an address or suspending them, are made per account.

Policy	Scope	Where in the console
Usernames, passwords, lockout	Realm	Realms, the realm’s Access and rules tab, Account rules
Who may sign in, approval channel	Client	Clients, Edit, Configuration
Network restriction	Client	The client’s Security tab, Network
New-address approvals	Account	IP Approvals
Suspensions	Account, per client	Suspensions

Changes to the account rules apply from the next sign-in or password change. The hosted screens read the same rules, so the hints next to a password field always match what the server enforces.

Usernames

Rule	Effect
Allowed Username Characters	The characters a username may contain. Empty allows any character.
Unique Email Required	No two accounts of the realm may share an e-mail address.

Password rules

The rules apply everywhere a password is written: an account created by an administrator, a password change, a reset, a password added to an account that came from an identity provider.

Rule	Accepted values
Minimum Length	1 to 128
Unique Characters	How many different characters; at most the minimum length
Special, Lowercase, Uppercase, Digits	On or off, each
Block breached passwords	On or off
Block Password Reuse and Passwords Remembered	1 to 24 remembered; 3 by default
Require Password Renewal and Renewal Every (days)	1 to 3,650 days; 90 by default

Breached passwords

With Block breached passwords on, a new password is checked against the Have I Been Pwned database using k-anonymity: only the first five characters of the password’s SHA-1 hash leave Authio, never the password. If the lookup does not answer within three seconds, the password is accepted rather than blocking the person.

Reuse and renewal

Block Password Reuse refuses a new password equal to any of the last Passwords Remembered. The current password always counts as recent.
Require Password Renewal makes passwords expire after Renewal Every (days). After the right password is typed, a person whose password expired is taken to renew it: the screen explains why and sends a reset link to their e-mail.

Lockout

Rule	Effect
Max Failed Attempts	Failures in a row before the account locks. At least 1.
Lockout Duration	How long the lock lasts, as `HH:MM:SS`, for example `00:05:00`.
Lockout Status	Whether lockout applies to new accounts.

A wrong password and a wrong e-mail code both count. A locked account is refused even with the right password; the sign-in screen states the realm’s own duration and number of attempts, and suggests resetting the password to get in sooner. In the console, the user’s page shows Locked out until with the time.

E-mail confirmation

An account cannot sign in until its e-mail address is confirmed, whatever the way in: password, passkey, push or identity provider. The exception is an account without a password created by an identity provider, whose address is confirmed when the provider is trusted and stated it verified it.

When an administrator creates an account, the Email Confirmed switch skips the confirmation e-mail. Left off, the person receives a link and cannot sign in until they follow it.
An administrator resends the link with Resend confirmation e-mail on the user’s page.
A person who tries to sign in unconfirmed is offered Send the confirmation email again — only after typing the right password. See Account self-service.

Accounts belong to the realm, not to a client. Each client decides which of them it admits with Restrict to linked accounts, under Who may sign in in its Configuration:

Setting	Who gets in
On (default)	Only accounts created through this client or granted access to it. Others are refused with “No access to this application”.
Off	Any account of the realm. It is linked to the client on its first sign-in.

Grant or remove access from the users list on the client’s Access tab. An account whose status is not Active cannot sign in anywhere, and changing the status ends all its sessions.

New-address approval

Each account may only be used from addresses it has used before or that someone approved. The first address an account signs in from is trusted automatically and becomes its reference. After that, a sign-in from an address the account has never used is held, even with the right password, until someone answers “was this you?”. This protects against leaked credentials whether or not the person enrolled a second factor.

The sign-in waits
The screen shows Confirm this location, says what it is waiting for, and continues by itself the moment the address is approved — without asking for the password again.
The account holder is asked
Through the client’s approval channel (below): an e-mail titled Was this you? with Yes, this was me and No, block this address, valid for 24 hours, or a request in the Authio app with the number shown on the screen. Opening the e-mail link decides nothing; only the button does, so mail scanners that follow links cannot approve anything.
Administrators can answer too
Operators are notified, and IP Approvals lists every held address of the realms in scope with Approve, Block and, for an approved one, Revoke. Each user’s Activity tab shows the addresses of that account.

An address the holder refuses stays refused for good, and operators get a critical notification: whoever tried knows the password. A refused address never raises a new question, so it cannot be used to flood the holder with e-mails. Nothing is deleted: revoking turns an approved address into a refused one.

Approval channel

The Approval channel, in the client’s Configuration, decides how the holder is asked about a new address and about a password reset:

Channel	How the holder is asked
The Authio app	A request on the paired phone, matching the number on the screen. An account without a phone gets the e-mail.
E-mail	Always a link in the inbox, never the phone.
Both	The phone, when there is one, and the e-mail as well; whichever is answered first decides.

The channel does not change the second factor: the sign-in code still goes to the inbox and to every paired phone.

Restricting a client to known networks

A client can admit sign-ins only from the networks you list — an office, a VPN gateway, CI runners. In the client’s Security tab, under Network:

Mode	Effect
Open to everywhere (default)	Any address, with each account still asked about addresses it never used.
Listed addresses only	Only the listed addresses, or one an administrator approves. The holder cannot approve their own address, and the first-address trust does not apply.

Entries are IPv4 or IPv6 addresses or CIDR blocks such as 203.0.113.0/24, each with a label.
You can build the list while the client is still open and switch to restricted later. Restricting with an empty list is refused.
Removing an address does not end sessions already open from it.
The restriction applies to people signing in — the hosted login, the password grant and device approval — not to machine identities at the token endpoint.

Suspensions

A suspension takes away all or part of a person’s access to a client for a period, without deactivating the account. Create one from Suspensions or from the user’s page in Users:

Level	While it is in force
Full suspension	No sign-in, no new tokens, and tokens already issued stop working.
Partial suspension	The person signs in, but the scopes you pick are withheld from every token.
Revoke permissions	The person signs in, but the roles you pick, or all of them, stop reaching their tokens.

Choose what happens to open sessions: Keep sessions open, Sign out now or Sign out when it starts. A full suspension always signs the person out.
A reason is required. Show the reason on the sign-in screen is off by default, because the reason is written for reviewers.
Access is decided from the dates at every check, so a suspension bites from its first second. Several suspensions add up, and the sign-in screen states the latest end.
A suspension is never edited: to change it, lift it with a reason and create another. Both stay in the history.

Next steps

Multi-factorAdd a second factor to the sign-in of a client.Account self-servicePassword reset and e-mail confirmation, from the person’s side.Audit and insightsThe access log and the trail of administrative changes.