> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aquaops.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Manage your password, two-factor authentication, and active sessions from Settings > Security.

## Purpose

Use this page to manage the security of your own AquaOps account — password, two-factor authentication (2FA), connected accounts, and active sessions/devices. This is personal account security, not an organization-wide setting: every signed-in user manages their own.

## Best for

* setting or changing your password
* enrolling in two-factor authentication
* reviewing and signing out other active sessions
* reviewing your account's connected sign-in methods

## Who can access this page

Go to:

```text theme={null}
Settings > Security
```

Unlike most of Settings, this page has no permission requirement — every signed-in user can see and use it, since it only manages their own account. It's grouped under **Account** in Settings, alongside Notifications and Kiosk PIN, rather than under Organization.

## What's on the page

The page embeds Clerk's account profile component directly, with its default **Security** tab. Depending on what's enabled for your account, this includes:

* **Password** — set or change your password
* **Two-step verification** — enroll or manage an authenticator app (TOTP) for two-factor authentication
* **Active devices** — see sessions currently signed in and sign out individual ones remotely
* your account's connected sign-in methods and email addresses (under the **Account** side of the same component)

## Enabling two-factor authentication

**1. Open Security**

Go to `Settings > Security`.

**2. Start two-step verification**

Find **Two-step verification** and choose to add an authenticator app.

**3. Scan the QR code**

Scan the code with an authenticator app (Google Authenticator, 1Password, Authy, or similar). If you can't scan it, use the manual entry key shown alongside it.

**4. Confirm with a code**

Enter the current 6-digit code from your authenticator app to confirm enrollment.

**5. Sign in with your second factor**

From your next sign-in onward, you'll be asked for a code from your authenticator app after your password.

> [!NOTE]
>
> AquaOps nudges accounts that hold `org:manage` to enroll in two-factor authentication, since those accounts have the broadest access — organization settings, user and permission management, and billing. Enrollment is encouraged, not required: there's no lockout if you skip it, and no other account type is nudged. Once you do enroll, entering a code at each sign-in is just how two-factor authentication works, not an extra AquaOps-specific step.

## Managing active sessions

The **Active devices** section lists sessions currently signed in to your account (browser/device, and when it was last active). You can sign out a specific session remotely from there without changing your password — useful if you signed in on a shared or borrowed device and forgot to sign out.

## Turning off two-factor authentication

From the same **Two-step verification** section, you can remove your authenticator app to turn 2FA off. If your account holds `org:manage`, expect to see the enrollment nudge again on your next visit, since it reappears until you re-enroll.

## What's not on this page

* Kiosk PIN sign-in is separate and managed from `Settings > Kiosk PIN`, not here — it's unaffected by your password or 2FA settings.
* There's no organization-wide toggle to require 2FA for all users; enrollment is a per-account choice (nudged, not enforced, for `org:manage` accounts).

## Best practices

* enroll in two-factor authentication if you hold `org:manage`, even though it's only nudged
* use a real authenticator app rather than skipping the QR step, since backup/recovery relies on it being set up correctly the first time
* review **Active devices** occasionally and sign out anything you don't recognize or no longer use
* don't share your password or authenticator setup between accounts — each user should enroll their own

## Suggested screenshots

* Security page with the Two-step verification section before enrollment
* QR code / manual entry step mid-enrollment
* Active devices list showing multiple sessions
* the `org:manage` enrollment nudge banner


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.