Account Security

Path: /admin/security · Sidebar: Administration → Account Security

Controls for authentication strength and programmatic access.

Multi-factor authentication (MFA)

• Enable TOTP-based MFA for your account (authenticator app).
• Admins can require MFA org-wide - the mandate is a runtime-tunable setting on the Security Policy (see below), not a redeploy.

Organization security policy

The Security Policy page sets authentication strength for the whole org from one place - password rules, lockout, session lifetime, and the org-wide MFA mandate.

• Presets - start from a named baseline instead of tuning every field: Baseline (NIST 800-63B), CIS Level 1, or Strict.
• Hardening-baseline badge - the page tells you at a glance whether the current policy meets the hardening baseline or is N settings below it, and lists the gaps (for example "MFA not required org-wide").
• Weaken-on-save warning - if a change would loosen the policy, saving is guarded by a danger confirm that names exactly what is being weakened, so a reduction in security posture is always deliberate and auditable.

API tokens

Create tokens for programmatic and CI/CD access:

• Tokens are prefixed apt_ and shown once at creation - copy them immediately.
• Scope and name each token by purpose (e.g. apt_… for "GitHub Actions - repo X").
• Revoke a token any time; revocation is immediate.

These tokens authenticate the CI/CD agent and any direct API use.

Password policy & lockout

• Enforce password complexity and rotation.
• Account lockout after repeated failed logins protects against brute force.

Sessions

Review and revoke active sessions if a device is lost or compromised.

Treat apt_ tokens like passwords

An API token is a credential. Store it in your CI secret store, never in source. If one leaks, revoke it here immediately - apPosture's own secrets scanner will flag apt_ tokens committed to code.