Secure your developer account

These settings protect the account you use to manage the SyAuth dashboard. MFA means an extra sign-in check, such as a code from an authenticator app. It is separate from security settings for users of your application.

To add an authenticator:

1. Sign in to the dashboard and open Settings → MFA.
2. Start authenticator enrollment and add the displayed QR code or secret to your authenticator app.
3. Enter a current code from that authenticator to confirm enrollment. Merely scanning the QR code does not complete setup.
4. Check that the factor appears as enrolled/active and save recovery codes securely when offered.

If a code is rejected, use the authenticator entry you just added and a fresh current code. If the setup attempt expired, start enrollment again. Add a passkey through the browser/device prompt if available; check that it appears in the saved credentials before relying on it.

When sign-in requires MFA, complete the challenge before accessing the dashboard. An expired verification attempt means restart sign-in. If you lose a factor, use an available recovery method or request account recovery through support.

Open Settings → Sessions to review and revoke developer-account sessions you no longer recognize or need. Revoke obsolete developer access tokens separately under Settings → General.

Revoking a session ends that dashboard sign-in; the affected browser will need to sign in again. Check which session you selected before confirming the action. Creating or revoking a dashboard session does not sign an application test user in or out.

These settings protect your own dashboard account. To add MFA and session management for people using your application, read application-user security.