Authentication and sessions

Multi-factor authentication is mandatory

Every account needs a password and a second factor before it can open a vault. MFA cannot be switched off in the interface.

Under Settings → Authentication a Super Admin chooses which methods users may enroll:

• Authenticator app (TOTP), with single-use offline recovery codes.
• Email code: a six-digit code that expires after four minutes, with resend throttling.

At least one method is always allowed; email-only is permitted. Each user holds exactly one method. If both are allowed, users pick one and can switch later.

Email-only accounts have no offline recovery codes. If they lose access to their mailbox, an administrator has to reset their factor.

Passwords

Outside local development, passwords must be at least 15 characters long and must not appear in known breaches. Changing a password or a factor revokes all other sessions.

Remember this device

When an administrator sets a Remember this device period greater than zero, the code prompt offers a checkbox. A remembered browser skips only the second-factor step for the configured number of days; the password is still required.

Remembered devices are revoked by any password, factor or account-status change, by Revoke all other sessions, and individually from the profile’s Trusted devices list. Setting the period to zero revokes every remembered device, and shortening it also shortens devices that are already remembered. A remembered device never counts for sensitive confirmations.

Session limits

Under Settings → Session security:

• Inactivity timeout, default 15 minutes.
• Absolute session lifetime, default and maximum 12 hours.

Both are enforced on every request, including for sessions that are already signed in.

Fresh re-authentication for sensitive actions

High-risk actions require your password plus a fresh second-factor code, even within an active session: changing factors, resetting another user’s factors, key rotation, emergency access and similar operations.

Recovering access

Situation	What to do
A user lost their authenticator	Use an unused recovery code, or ask a Super Admin to Reset authentication.
An email-only user lost their mailbox	A Super Admin resets their factor.
One of several admins is locked out	Another Super Admin resets their factor.
The only Super Admin is locked out	Run the local recovery command on the server (below).

Recovering the sole administrator

There is no web-based bypass. A person with shell access to the trusted host runs:

php artisan vaultigen:recover-admin [email protected]

On Docker Compose: docker compose exec web php artisan vaultigen:recover-admin [email protected].

Enter a temporary password at the hidden prompt. The command revokes sessions, remember tokens, reset tokens, remembered devices and old factors, and records a security event. The next sign-in must set a new password and enroll a factor. It does not replace lost installation keys.

Keep at least two independent ways back in: two administrators, plus saved recovery codes.

Clock accuracy

Authenticator codes depend on the server’s clock. If codes are rejected, check that the server runs NTP and that the phone’s clock is correct.