Account security

Password, e-mails, authenticator app (TOTP), passkeys, e-mail code, linked accounts, account recovery and what Axuz requires before a full session is opened.

Axuz identity lives in a separate app, auth (auth.axuz.club in production). Everything that protects your account — sign-in methods, password, sessions — is managed there, under Account security (/settings/security). The other apps just point to that page.

What Axuz requires

A full session requires the account to have a password, a primary e-mail and an authenticator app or a passkey. Whoever lacks any of these gets a restricted session: only the security settings work, and the Add a sign-in method screen lists what is missing (Set a password, A primary email, An authenticator app or a passkey). Once you add what is missing, the session is unlocked and you return to where you were.

On top of that, every sign-in asks for a second factor. A correct password, or signing in with Google or GitHub, counts only as the first factor: the session opens only after Two-step verification, using Passkey, Authenticator app or Email code. The e-mail code is always available because every account has an e-mail. The challenge lasts 10 minutes and allows 5 attempts in total; beyond that, go back and sign in again.

Password

Under Password, enter New password and Confirm new password, then Save password. Requirements: at least 12 characters, with a letter and a number, at most 1024 bytes, and not present in known breaches. Changing the password signs out all other sessions and first asks you to confirm with another factor. For accounts created through Google or GitHub, this is how you set a password.

Authenticator app (TOTP)

Under Authenticator app (TOTP), click Set up authenticator app, scan the QR code (Google Authenticator, 1Password, Authy and similar) or type the manual key, enter the 6-digit code and click Activate. The screen then shows the recovery codes: keep them somewhere safe, each works once and they are not shown again. Click I saved them only after copying them. Later you can ask for New recovery codes or Turn off, entering the current code (or a recovery code). At sign-in, Use a recovery code instead lets you in without the app.

Passkeys

Under Passkeys, Manage passkeys opens the registration page. Give it a nickname (for example “MacBook Touch ID”), click the register button and approve in the browser with biometrics, PIN or a security key. The list shows registration date, last use and whether the passkey is synced, with a remove button for each. You can have several. On the sign-in screen, Sign in with passkey works with or without typing your e-mail first, and requires confirming it is you (PIN or biometrics).

E-mails and linked accounts

Under E-mail addresses, Add e-mail sends a 6-digit code (valid for 10 minutes) to the new address. Each verified additional e-mail counts as a sign-in and recovery method. You can Make primary, Verify and Remove; removing an e-mail stops it from signing in or recovering the account. Under Connected accounts, Link attaches a Google or GitHub account as a sign-in method and Unlink removes it. Linking is never automatic: if an account already exists with the provider’s e-mail, sign in to it and link here. You can never remove your last way to sign in.

Confirming it’s you

Changing a method (password, TOTP, passkeys, e-mails, links) opens Confirm it’s you: confirm with a factor other than the one you are changing, preferring the strongest available (passkey, then authenticator app, then e-mail code, then password). The confirmation lasts 5 minutes.

Forgot password and recovery

Under Forgot my password, enter your e-mail. If it is registered, you receive a link valid for 60 minutes. If the account has another method (authenticator app or recovery code, passkey, additional e-mail or linked Google/GitHub), the link is not enough: the Confirm it’s you step asks for one of them. If the account has none yet, the e-mail link suffices, and afterwards you must add an authenticator app or a passkey. Resetting the password revokes all sessions. Lost access to every method? Use Open a ticket with the account’s e-mail; once support releases the recovery, request a new link under Forgot my password — the release lasts 24 hours and works once.