Account security

Enable two-factor authentication

1. Sign in, open Account → Security, and enter your current password in the confirmation field.
2. Add at least one method: an authenticator app, a passkey, or a USB security key. Adding the first method turns two-factor authentication on for your account.
3. Save the ten recovery codes when they appear. Each code works once and is never shown again.

Authenticator app

Choose Set up authenticator app, scan the QR code, then enter the current six-digit code to finish enrollment. The standard TOTP format works with 1Password, Google Authenticator, Authy, Microsoft Authenticator, and compatible apps. The encrypted seed stays on the User row; Genosyn does not enable it until the first code verifies successfully.

Passkeys

Give the credential a recognizable name, then choose Add passkey. Your browser can offer Touch ID, Face ID, Windows Hello, a password-manager passkey, or a nearby device. The private key stays in the authenticator; Genosyn stores only the public key and verification counter.

USB security keys

Choose Add USB security key to steer the browser toward a roaming FIDO2 key. Insert or tap the key and complete its PIN or verification prompt. YubiKey 5 and other FIDO2/WebAuthn-compatible keys work; older OTP-only YubiKeys do not provide a WebAuthn credential.

HTTPS and publicUrl

Browsers allow WebAuthn only on secure origins. localhost is the development exception; every remote deployment needs HTTPS. The hostname in config.publicUrl is the WebAuthn relying-party ID and its origin is used to verify every registration and sign-in, so it must exactly match the URL Members use to open Genosyn. See Configuration.

Sign in with 2FA

Enter your email and password, or complete SSO as usual. If your account has two-factor authentication enabled, Genosyn creates a five-minute verification step instead of a full session. Use any enrolled passkey/security key, a current authenticator code, or an unused recovery code. Eight failed second-factor attempts restart the sign-in flow.

Manage methods

• Add more than one passkey or security key so a spare device can get you back in.
• Remove individual methods from Account → Security. Removing the last method turns 2FA off and clears recovery codes.
• Generate new codes invalidates every existing recovery code immediately and displays a fresh set once.
• Turn off two-factor authentication removes the authenticator app, all passkeys/security keys, and all recovery codes.