Org Security & Seats

Set login security for everyone in your organization — require two-factor and an idle auto-sign-out per seat, or set an org default and apply it to all. Members can choose a stricter personal timeout; they can’t go below the org floor.

Organization defaults

Require two-factor (MFA)

Off

Idle auto sign-out

Defaults seed every seat below. Per-seat overrides win. Enforcement of MFA and the idle floor server-side is a Code item (t-org-seat-policy, t-auth-window) — today these choices are saved and drive the client gate.

Hardware security keys FIDO2 / WebAuthn

Add a physical key (YubiKey 5C, passkey, or platform authenticator) as the strongest second factor for admin accounts. A registered key is phishing-proof — it only works on acquisto.biz.

Register a key for this admin account

Insert your key (or use Touch ID / Windows Hello), then name it so you can revoke it later if it's lost.

Backend (Lane B / Code): the browser ceremony here (navigator.credentials.create) is real, but a key is only trusted once the server verifies + stores it. Needs mcp_webauthn_register_begin/finish (store credential id + public key on pure_webauthn_credentials) and assert on login (t-webauthn-verify). Until then keys register locally for the enrollment UX and are listed below. Set per-org require_hardware_key alongside mfa_required.

Org Security & Seats · roster from the PURE directory ·