Skip to main content

Account Security

Path: /admin/security · Sidebar: Administration → Account Security

Controls for authentication strength and programmatic access.

Multi-factor authentication (MFA)​

  • Enable TOTP-based MFA for your account (authenticator app).
  • Admins can require MFA org-wide via policy.

API tokens​

Create tokens for programmatic and CI/CD access:

  • Tokens are prefixed apt_ and shown once at creation - copy them immediately.
  • Scope and name each token by purpose (e.g. apt_… for "GitHub Actions - repo X").
  • Revoke a token any time; revocation is immediate.

These tokens authenticate the CI/CD agent and any direct API use.

Password policy & lockout​

  • Enforce password complexity and rotation.
  • Account lockout after repeated failed logins protects against brute force.

Sessions​

Review and revoke active sessions if a device is lost or compromised.

Treat apt_ tokens like passwords

An API token is a credential. Store it in your CI secret store, never in source. If one leaks, revoke it here immediately - apPosture's own secrets scanner will flag apt_ tokens committed to code.

Last updated on