Sign-in and security

This page turns two-step verification on or off for the whole platform, and sets whether the sign-in page remembers people for 30 days or asks them to sign in again every time they close the browser.

Your role needs Can edit configuration.

Turn on two-step verificationCopy Anchor Link

The Turn on two-step verification switch applies to every App on the platform at once.

• On: everyone must use two-step verification on every App. People who have set it up must enter the 6-digit code every time they sign in. People who have not are taken to set it up the next time they sign in (Two-step verification).
• Off: nobody is asked for a code, including people who set it up before. Each person's setup is kept and used again when you turn the switch on.

To change it, do this.

1. Open Sign-in & security.
2. Turn the Turn on two-step verification switch on or off. Under the switch is a description of the value you chose.
3. Press Save. If you are turning it on, a dialog asks you to confirm. Press Turn on and sign everyone out.

When you turn the switch on, everyone is signed out at once, including you, and must sign in again with a two-step code. When you turn it off, the change applies to the next sign-in, and when someone picks an existing account in the Choose an account list.

Sign in again every time the browser closesCopy Anchor Link

Normally the sign-in page remembers people for 30 days. To change that, do this.

1. Open Sign-in & security.
2. In the Session box, add "cookieExpires": "session" after the keys already there (JSON editor).
3. When the bar under the box says Valid JSON, press Save.

{
  "enabled": false,
  "duration": 10,
  "onAction": "logout",
  "cookieExpires": "session"
}

The change applies to the next sign-in. An account the browser has already remembered stays in the Choose an account list until its owner removes it. To go back to 30 days, delete the cookieExpires line and save.

The keys enabled, duration and onAction have no effect in this Release. Leave them as they are.

Use another value for one OAuth clientCopy Anchor Link

If one program needs a value different from the whole site, put "idleDetection": { "cookieExpires": "session" } in the Extended properties of that program's OAuth client (OAuth clients). When a client has its own idleDetection, the sign-in page ignores the site-wide value completely.