Skip to main content

Sign-in, Security, and Settings

This page is for end users of an ItBuild project powered by AuthProxy. It explains what you may see when signing in, what security methods are commonly available, and what you can usually manage in the settings area after login.

What you may see on the sign-in screen​

Your project can enable one or more sign-in methods. Because AuthProxy is configured per project, the available options may differ between environments or customers.

Common sign-in methods include:

  • Passkey / user key for fast, passwordless sign-in
  • FIDO2 / WebAuthn using a security key or supported device
  • Phone OTP sent by SMS
  • Email OTP or magic link
  • Social login such as Google, Telegram, GitHub, Discord, Facebook, or VK
  • Partner login / federation if your organization uses another ItBuild project as an identity provider

If you do not see a method you expected, it is usually disabled for your project or not configured for your account yet.

Why the screen can look different on another device​

The same project may show sign-in options differently on desktop and mobile:

  • desktop often groups methods into a shared shell
  • mobile may show them as separate cards or pages

This does not mean the project uses different security rules. It is only a difference in presentation.

After you sign in​

Most projects expose a settings area where you can manage security and account-related actions.

Typical sections include:

  • Sessions: review active sessions and sign out from other devices
  • User keys / passkeys: create, remove, or manage sign-in keys
  • Login and sign history: review recent access and signature activity
  • Applications / app access: manage connected apps, webhook-oriented app settings, or access grants
  • Profile / identifiers: review linked contact methods or profile details

The exact list depends on the project and enabled modules.

Keys and passkeys​

Your project may support one or more key-based methods:

  • a platform user key
  • a browser/device passkey
  • a hardware-backed FIDO2 security key

Why teams prefer keys:

  • faster sign-in
  • better phishing resistance than passwords
  • fewer OTP prompts during daily use

If your organization recommends passkeys, that usually means the key-based path is the preferred login method for your project.

Optional PIN sign-in on a trusted device​

Some projects allow you to save a four-digit PIN after a successful phone-and-password sign-in. When enabled, select Save PIN for next login, enter the PIN twice, and complete the normal sign-in. On your next visit, AuthProxy can ask for that PIN instead of the full password.

The PIN shortcut is local to that browser:

  • Use password skips the PIN screen without removing the saved shortcut
  • Forget this device removes the saved shortcut from the browser
  • changing your password elsewhere invalidates the saved shortcut
  • eight failed PIN attempts remove the shortcut and require the password again
  • signing out does not remove the shortcut
Trusted devices only

The four-digit PIN is a convenience feature, not a replacement for FIDO2/WebAuthn or a strong password. It protects the saved sign-in key from casual access through the normal screen, but a person who can copy the browser's site data can test all PIN combinations offline. Do not enable it on a shared or untrusted device.

Sessions​

If you suspect another device still has access to your account, open the sessions page and revoke sessions you no longer trust.

Typical session actions:

  • review current device vs other devices
  • close one session
  • close all other sessions

If you closed sessions but another browser still appears active, wait for the page to refresh and sign out locally on that device as well.

Login and sign history​

Some projects show:

  • login history: successful sign-ins
  • sign history: confirmations or signatures performed with your key

This helps answer:

  • when did I log in?
  • from which device or browser?
  • did I confirm an action myself?

Applications and connected access​

If your project exposes application access management, you may see:

  • apps you created or connected
  • webhooks or callback-related settings
  • linked access rules for other modules

Only use app-creation and key-creation features if your role requires them. These options are often intended for advanced users, integrators, or internal operators.

Branding and theme differences​

The project name, logo, and colors can vary between customers, environments, or dark/light themes. This is expected. AuthProxy supports runtime branding, so visual changes do not always correspond to a new frontend release.

Common questions​

I see different login options on dev and production​

That usually means the environments are configured differently. Dev stands may temporarily expose extra methods for testing.

My dark theme looks branded, but light theme looks old​

This is typically a deployment issue with theme assets, not a problem with your account.

I cannot create a new key​

Some projects require:

  • an existing verified session
  • a confirmed OTP step
  • project permission to register new keys

If the option is missing entirely, ask your project operator whether key registration is enabled.

When to contact support​

Contact your project operator or support team if:

  • you no longer have access to any enabled sign-in method
  • expected login methods disappeared after a deployment
  • your branding/theme looks partially updated
  • session or key actions fail repeatedly