Authentication & 2FA

Outcron supports multiple authentication methods to secure your account and provide flexible access options.

Password Authentication

The primary login method uses email and password. Passwords are hashed with bcrypt and never stored in plaintext.

Password Reset

If you forget your password, request a reset from the login page. A time-limited reset link is sent to your email address.

• Users with or without 2FA receive a reset link.
• For accounts with 2FA enabled, the reset email notes that 2FA remains active after the password reset and includes support contact guidance for account-recovery help.

Two-Factor Authentication (TOTP)

Add a second layer of security with time-based one-time passwords (TOTP). Compatible with any authenticator app (Google Authenticator, Authy, 1Password, etc.).

Enabling 2FA

1. Go to Account settings.
2. Click Enable 2FA.
3. If your account has a password, enter your current password.
4. Scan the QR code with your authenticator app.
5. Enter the current code to confirm.
6. Save your recovery codes in a secure location.

Changing or Disabling 2FA

Changing an active authenticator or disabling TOTP requires account step-up: enter your current password plus a current authenticator code or recovery code. Authenticator changes keep the existing TOTP factor active until the new setup is verified.

Login with 2FA

When 2FA is enabled, login becomes a two-step process:

1. Enter your email and password.
2. Enter the current TOTP code from your authenticator app.

Challenge tokens expire after 5 minutes and allow a maximum of 3 attempts.

Failed TOTP and recovery-code submissions share the same account login throttle as failed password attempts.

Recovery Codes

Recovery codes are one-time-use backup codes that bypass TOTP. Each code can only be used once and is durably invalidated after use so it cannot be replayed after a restart. Generate new recovery codes if you run out.

Account Step-Up

Credential-management actions require a fresh proof:

First-time TOTP setup is the exception for accounts with no password and no TOTP: it remains available without step-up so passwordless accounts can add their first verifier.

Passkeys (WebAuthn)

Passkeys provide passwordless login using device authenticators (Touch ID, Windows Hello, security keys).

Setting Up a Passkey

1. Go to Account settings.
2. Click Add Passkey.
3. Complete account step-up with your current password and, if TOTP is active, a current authenticator or recovery code.
4. Follow your browser's prompts to register the authenticator.
5. Give the passkey a name for identification.

Deleting a passkey also requires the same account step-up proof. If a passkey is the final usable login method for a passwordless account, deletion remains blocked.

Login with Passkey

Discoverable passkey login bypasses both the password and TOTP steps. Click Sign in with passkey on the login page and follow the browser prompt.

Session Management

• Browser sessions keep short-lived access JWTs in memory only and use HttpOnly refresh cookies for reloads and idle renewal.
• API and CLI bearer tokens expire after the configured JWT lifetime, 24 hours by default. Use the refresh endpoint or re-login to get a new token.
• Password changes revoke existing browser sessions and issue a fresh session for the current browser.
• Sessions are validated on every request: if your account is deactivated, your email changes, your password changes, or your browser session is revoked, the session is rejected immediately.

Email Verification

New accounts require email verification before login is allowed. A verification link is sent to your email address during signup.

• Verification tokens are encrypted and single-use.
• You can request a new verification email from the login page if the original expires.