Skip to main content

​
Overview

Tracecat supports FIDO2 security keys and passkeys as a second factor at sign-in. Any WebAuthn authenticator that verifies the user with a PIN or biometric works, including:
  • Hardware keys such as the YubiKey 5 and Security Key series.
  • Passkeys saved in Chrome and Google Password Manager, 1Password, iCloud Keychain, or Windows Hello.
Tracecat rejects older U2F-only keys that cannot verify a PIN or biometric. Once you register a key, Tracecat asks for it at every sign-in. This applies to password, OIDC, and SAML sign-in alike. Service account API keys are not affected. Until you register your first key, your password or SSO sign-in is the only factor on your account, and anyone who signs in as you can register that first key. Register yours as soon as your organization requires one.

​
Requirements

Browsers only offer security keys on HTTPS or localhost. Tracecat takes the relying party ID and origin from TRACECAT__PUBLIC_APP_URL, and keys stay bound to that host. If you change the domain, every user has to register their keys again. On a deployment served over plain HTTP or from an IP address, the MFA settings stay disabled and show the reason.

​
Register a security key

Open Settings, select Security, enter a name for the key, and select Add security key. Then follow your browser’s prompt to tap your key or confirm a passkey. Security keys and passkeys in Settings When you register your first key, Tracecat shows 10 recovery codes once. Store them somewhere safe: each code signs you in once if you lose your key. Select Generate new recovery codes to replace the whole set. Recovery codes shown after registering a key You can register several keys and remove any of them from the list. Tracecat blocks removing your last key while your organization requires one.

​
Sign in with a security key

After your password or SSO sign-in, Tracecat opens /mfa and asks for your key. Until you verify, the session can only reach the MFA screen and sign-out. Security key prompt at sign-in If you’ve lost your key, select Use a recovery code and enter one of your saved codes.

​
Require MFA for an organization

An organization administrator with org:settings:update can turn on Require security key under Multi-factor authentication at /organization/settings/security. You must have registered a key yourself before you can turn it on. Require security key for an organization Members without a key must register one at their next sign-in before they can continue. Members who already have a key get the security key prompt instead. Existing sessions that haven’t verified with a key are stopped at the MFA screen on their next request. Policy changes reach every API replica within 30 seconds. Required key registration at sign-in The check runs at sign-in. If any of your organizations requires MFA, you verify with your key when you sign in, whichever organization you open afterwards.
  • See IP allowlist to restrict sign-in and admin access to approved addresses.
  • See SAML and OIDC to configure single sign-on alongside security keys.