Account security

Email verification and passwords

Shared SaaS mode sends a single-use verification link after signup. A Member must verify that address before creating a company or accepting an invitation, and the signed-in address must exactly match the invitation recipient. New and reset passwords require at least 12 characters. A password change or reset invalidates every older signed-in session.

Enable two-factor authentication

1. Sign in, open Account → Security, and enter your current password in the confirmation field.
2. Add at least one method: an authenticator app, a passkey, or a USB security key. Adding the first method turns two-factor authentication on for your account.
3. Save the ten recovery codes when they appear. Each code works once and is never shown again.

Authenticator app

Choose Set up authenticator app, scan the QR code, then enter the current six-digit code to finish enrollment. The standard TOTP format works with 1Password, Google Authenticator, Authy, Microsoft Authenticator, and compatible apps. The encrypted seed stays on the User row; Genosyn does not enable it until the first code verifies successfully.

Passkeys

Give the credential a recognizable name, then choose Add passkey. Your browser can offer Touch ID, Face ID, Windows Hello, a password-manager passkey, or a nearby device. The private key stays in the authenticator; Genosyn stores only the public key and verification counter.

USB security keys

Choose Add USB security key to steer the browser toward a roaming FIDO2 key. Insert or tap the key and complete its PIN or verification prompt. YubiKey 5 and other FIDO2/WebAuthn-compatible keys work; older OTP-only YubiKeys do not provide a WebAuthn credential.

HTTPS and the public URL

Browsers allow WebAuthn only on secure origins. localhost is the development exception; every remote deployment needs HTTPS. The public URL saved at Admin → General supplies the WebAuthn relying-party ID and origin, so it must exactly match the URL Members use to open Genosyn. See Configuration.

Sign in with 2FA

Enter your email and password, or complete SSO as usual. If your account has two-factor authentication enabled, Genosyn creates a five-minute verification step instead of a full session. Use any enrolled passkey/security key, a current authenticator code, or an unused recovery code. Eight failed second-factor attempts restart the sign-in flow.

Manage methods

• Add more than one passkey or security key so a spare device can get you back in.
• Remove individual methods from Account → Security. Removing the last method turns 2FA off and clears recovery codes unless a company you belong to requires 2FA.
• Generate new codes invalidates every existing recovery code immediately and displays a fresh set once.
• Turn off two-factor authentication removes the authenticator app, all passkeys/security keys, and all recovery codes.

Require 2FA for a company

An owner or admin who already has 2FA can open Settings → Company and turn on Require two-factor authentication. Members without a method must enroll one under Account → Security before they can access or join that company. Genosyn then prevents them from removing their final method. See the full hosted baseline in Shared SaaS mode.