Two-factor and step-up
An authenticator app adds a second factor to your Stridge account. Once it is set up, you sign in with your password, an emailed code and a code from the app. Sensitive actions in live also ask you to confirm it's you again with a fresh code. This is called step-up.
Owners need an authenticator app to go live, and to move money, manage live API keys and manage the team once the workspace is live.
Set up an authenticator app
You need an authenticator app on your phone, such as Google Authenticator, 1Password or Authy.
Open the account menu and choose Security. Under Authenticator app, choose Enable authenticator.
Because this changes how you sign in, the dashboard first asks you to confirm it's you. Choose Email me a code, enter the 6-digit code from the email, and choose Confirm.
Scan the QR code with your authenticator app. If you can't scan it, type the key shown under Or enter this key manually: into the app instead.
Enter the 6-digit code your app shows and choose Confirm and enable.
The dashboard shows your backup codes. Store them somewhere safe, apart from your phone, then choose Done.
Each authenticator code works once. If a code was just used, wait for the app to show the next one.
Backup codes
Backup codes let you in if you lose your authenticator app. Each code works once. The Backup codes section on Security shows how many you have left.
To get a new set, choose Regenerate and enter a current code from your authenticator app. Your old backup codes stop working at once. Store the new ones and choose Done: they are not shown again.
Turn off the authenticator app
On Security, under Authenticator app, choose Disable and enter a current code. While it is off, you can't take the live actions that need an authenticator.
Step-up: confirm it's you
When an action needs a fresh second factor, the dashboard opens Confirm it's you. Enter the 6-digit code from your authenticator app and choose Confirm. You can also:
- choose Use a backup code and enter one of your backup codes, or
- choose Email me a code and enter the code from the email, when the action accepts one.
The action then goes ahead.
How long a confirmation lasts
- Live actions: once you confirm, you aren't asked again for 15 minutes while you keep working. Each action you take restarts the 15 minutes.
- Account changes: changing your password or email, setting up or turning off the authenticator app, and regenerating backup codes need a code entered in the last 5 minutes. That code confirms one action only.
Which actions ask
The sandbox never asks, except for account changes and acting on an owner. API requests made with an API key never ask.
| Action | Where | What it accepts |
|---|---|---|
| Create a payout or transfer | Live | Authenticator or backup code |
| Change routing policies, treasuries, treasury rules or signing policies, or link a deposit address to a policy | Live | Authenticator or backup code |
| Create or rotate a live API key that can move money, or give one more access | Live | Authenticator or backup code |
| Invite members, change roles, suspend or remove members | Live workspace | Authenticator or backup code |
| Change the billing payment method | Live workspace | Authenticator or backup code |
| Add, demote, suspend or remove an owner | Always | Authenticator or backup code, or an emailed code if you have no authenticator |
| Add, edit or delete a webhook endpoint | Live | Authenticator, backup or emailed code |
| Change notification routing or billing settings | Live workspace | Authenticator, backup or emailed code |
| Change your password or email, set up or turn off the authenticator, regenerate backup codes | Always | Authenticator, backup or emailed code |
"Live workspace" means the action asks once your workspace has gone live, whichever environment you are in.
If an action needs an authenticator and your account doesn't have one, the dialog says so and offers Set up an authenticator.
Sign-in and sessions
With an authenticator app set up, signing in asks for the emailed code and the code from your app. On Security you can also change your password and see Active sessions: sign out one device, choose Log out other sessions, or Sign out everywhere.
For how Stridge protects API access, see Security model on the Developers surface.