Skip to main content

Multi-Factor Authentication & Security Policies

PostQode Enterprise provides multi-layered authentication security and active session controls through the Security Management console (/security) and Organization Settings (/organization), protecting corporate workspaces, proxy credentials, and developer sessions.

1. Multi-Factor Authentication (MFA) Methods​

PostQode supports dual-factor authentication methods to protect developer and administrator accounts:

PostQode Web Console ➔ Security Settings (/security) ➔ MFA Security Tab

Supported MFA Methods​

MethodTypeDescription
Authenticator App (TOTP)Time-Based OTPStandard 6-digit rotating codes generated by apps like Google Authenticator, Microsoft Authenticator, 1Password, or Authy.
Email OTPEmail Verification6-digit one-time passcodes dispatched directly to the account's registered email address.

2. Setting Up MFA for Your Personal Account​

Step 1: Authenticator App (TOTP) Setup​

  1. Log in to the PostQode Web Console at https://app.postqode.ai.
  2. Navigate to Security (/security) from the user profile dropdown or sidebar.
  3. Under the MFA Security tab, locate Multi-Factor Authentication (MFA) and click Setup 2FA.
  4. Scan the presented QR code with your authenticator application (or manually copy the secret key).
  5. (Optional) Provide a recognizable Device Name (e.g. Work MacBook Pro Authenticator).
  6. Enter the 6-digit confirmation code from your authenticator app and click Verify & Enable.

Step 2: Email Authentication Setup​

  1. In the MFA Security tab, click Enable Email Authentication (or toggle the Email MFA switch).
  2. PostQode dispatches a verification code to your registered email address.
  3. Enter the verification code in the confirmation modal to activate Email OTP.

Managing Trusted MFA Devices​

  • View all registered TOTP authenticators in the Registered MFA Devices table.
  • Rename device labels or remove obsolete devices at any time.

3. Web Session Management (/security)​

Under the Web Sessions tab in the Security console, users and administrators can inspect and manage all active login sessions across devices:

Active Session Telemetry​

  • Device & Client: Operating system, browser family, and hardware type (Laptop, Mobile, Desktop).
  • Network Metadata: Remote IP address and geo-location.
  • Activity Timestamps: Initial login creation date and live lastActiveAt relative timestamp.
  • Current Session Indicator: Pinned badge highlighting your current active browser session.

Granular Session Actions​

  • Refresh Sessions: Polls real-time connection status across all active devices.
  • Revoke Individual Session: Immediately logs out a specific forgotten browser or laptop.
  • Revoke All Others: A single-click nuclear action that terminates all sessions across all devices except the current active window, instantly mitigating unauthorized access.

4. Organization-Wide MFA Enforcement​

Organization Administrators can mandate two-factor authentication across all engineering teams and developers:

Organization Management ➔ Organization Settings Dialog ➔ Enforce MFA
  1. Navigate to Organization (/organization) in the PostQode Web Console.
  2. Click Organization Settings in the top-right corner.
  3. Toggle the Enforce MFA switch to Enabled (updates take effect immediately).

Enforcement Behavior​

  • Once enforced, any member logging in without an active MFA method is automatically redirected to the MFA setup onboarding wizard before they can access organization workspaces, teams, or shared Gateway Proxy keys.

5. Password & Account Recovery​

  • Update Password: Users can rotate their master password securely from the /security sheet with old password verification.
  • MFA Recovery Flow (/mfa-recovery): If a developer loses access to their authenticator device, they can utilize backup recovery credentials or initiate an administrative recovery request.
Is this documentation incorrect or incomplete? Report an issue on GitHub