# Two-factor authentication & SSO

> Protect every account with passkeys or TOTP and connect your identity provider via SAML or OIDC.

Source: https://docs.avenlith.com/en/two-factor-and-sso  
Category: Security & compliance  
Last updated: 2026-09-22

## Two-factor authentication

Go to **Account → Security** and add a passkey (WebAuthn) or an authenticator app (TOTP). Save the ten recovery codes somewhere safe.

Project owners can make 2FA mandatory for all members under **Project → Settings → Security**.

## Single sign-on

SAML 2.0 and OpenID Connect are supported — Okta, Microsoft Entra ID, Google Workspace, Keycloak and others. Use these values in your identity provider:

```text
Entity ID:          https://console.avenlith.com/saml/metadata
ACS URL:            https://console.avenlith.com/saml/acs
Name ID format:     emailAddress
Attributes:         email, firstName, lastName, groups
```

Groups from the identity provider can be mapped to Avenlith roles, so access is removed automatically when someone leaves the company.

> **Warning:** > Keep one owner account with a passkey outside SSO as break-glass access in case your identity provider is unavailable.