Skip to main content

Account Security

This page covers securing the account you sign in with. For authenticating API requests, which is a separate mechanism, see Authentication and API Keys.

Signing in​

Fil One supports four sign-in methods:

  • Passkeys, the primary method
  • Google
  • GitHub
  • Email with password

A new account must verify its email address before the dashboard opens. Until you do, every page redirects to a verification screen.

Two-factor authentication​

Two-factor authentication is opt-in per user and managed from Settings, under Security. Three factor types are supported:

FactorShown in the dashboard asWhat it is
Authenticator appAuthenticator app (OTP)A time-based one-time code from an app such as 1Password, Authy, or Google Authenticator
Security keySecurity keyA roaming WebAuthn authenticator, for example a YubiKey
Device biometricsDevice biometricsA platform WebAuthn authenticator: Face ID, Touch ID, or Windows Hello

SMS and email codes are deliberately not offered. Both are vulnerable to SIM-swap and mailbox-compromise attacks, so Fil One only supports factors bound to a device or an app.

You can enrol more than one factor and remove individual ones from Settings.

Signing in with a passkey counts as a strong factor, so you aren't asked for a second factor on top of it.

Passkeys​

Passkeys are listed separately from two-factor methods in Settings, under Passkeys. If you have none enrolled, the dashboard prompts you to add one on your next sign-in.

You can hold up to 20 passkeys on one account, which is enough to cover several devices without having to retire an old one to add a new one.

Accounts that sign in with Google or GitHub don't see the Passkeys section.

Recovery codes​

A recovery code is a single-use code for signing in if you lose access to your authenticator. Generate or replace one from Settings → Security → Recovery code → Regenerate.

Generating a new code invalidates the previous one, so store the new value somewhere durable before you close the dialog.

Changes to security settings require re-authentication​

Four actions require a session that was signed in with two-factor authentication or a passkey, even inside an already signed-in session:

  • Removing a two-factor method
  • Removing all two-factor methods
  • Removing a passkey
  • Regenerating a recovery code

If your current session wasn't, the dashboard sends you back through sign-in to step up before the action proceeds. This means a session signed in with a password alone cannot strip the account's protections.

Transferring ownership of an organization has a stricter check: you must have signed in within the last five minutes, and if you have two-factor authentication set up, that sign-in must include it or use a passkey. Otherwise the dashboard sends you back through sign-in first.

Changing your password​

Change your account password from Settings → Security → Password → Change. This sends a password-reset email to your registered address.

If you sign in with Google or GitHub, there is no password to change in Fil One. Settings shows the password as Managed by Google (or GitHub), with a link to update it with that provider.