Email and password, Google or Apple
A passkey, a security key or an authenticator on top, if you want one. Paste everything from Bitwarden.
Authenticator app482 913
Passkey or security keyactive
Backup codes8 of 10 left
- One sign-up per team, an invitation per person. An administrator invites teammates from the app (name, e-mail); each gets a link that works once, for seven days at most.
- A second factor for whoever wants one, or for the whole team: an authenticator app, a security key or a passkey (a YubiKey, Bitwarden, a phone).
- Ten backup codes, shown once, to keep in the password manager.
- A key is not fooled by a fake site. A security key or a passkey only signs for the real domain.
- Fingerprints, not secrets. Passwords, invitation codes, backup codes and tokens are stored as fingerprints (scrypt, SHA-256).
- A forgotten password means a new invitation: it closes every other session, and the second factor is still asked.
Assistants have their own token
One per person and per assistant, revoked on its own. Over MCP, nothing that cannot be undone in the app: a deletion goes to the trash for thirty days.
How assistants connect