Two-factor authentication & SSO

Two-factor authentication#

Go to Account → Security and add a passkey (WebAuthn) or an authenticator app (TOTP). Save the ten recovery codes somewhere safe.

Project owners can make 2FA mandatory for all members under Project → Settings → Security.

Single sign-on#

SAML 2.0 and OpenID Connect are supported — Okta, Microsoft Entra ID, Google Workspace, Keycloak and others. Use these values in your identity provider:

Entity ID:          https://console.avenlith.com/saml/metadata
ACS URL:            https://console.avenlith.com/saml/acs
Name ID format:     emailAddress
Attributes:         email, firstName, lastName, groups

Groups from the identity provider can be mapped to Avenlith roles, so access is removed automatically when someone leaves the company.