Account Security

Two-factor sign-in, your signed-in devices, sign-in alerts and the security checklist.

Everyone on your team signs in with an email and password. These features make a stolen or guessed password much less useful.

With two-factor sign-in on, signing in needs your password and a six-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.

To turn it on, open Your account from the account menu and select Set up two-factor sign-in:

Scan the QR code with your authenticator app, or type the key shown under it.
Enter the six-digit code your app shows and your password, and select Turn on.
Save your ten recovery codes. Copy them or download them, and keep them somewhere safe, away from your phone.

Each recovery code signs you in once, if you lose your phone. They are shown only once. Under Your account you can see how many are left, and make a new set, which replaces the old one.

To turn two-factor sign-in off, you need your password and a code from your app, or a recovery code. It cannot be turned off while your station requires it.

Lost your phone and your recovery codes

An owner or administrator can select Reset two-factor for you under User Management. You can then sign in with your password and set it up again. Administrators can only do this for the roles they manage.

Locked out of the owner account

If an owner forgets their password, or loses their phone and their recovery codes, and no other owner can help, select Recover the owner account on the sign-in page. Enter the SETUP_TOKEN from your server's .env file and the owner's email. Auvyra turns off two-factor sign-in for that account, signs it out everywhere, and shows a temporary password once. Sign in with it and choose a new password under Your account.

Only owners can be recovered this way, and only with the setup token, so keep your .env file private. Each recovery is recorded in the activity history and emailed to the owner.

Requiring it for the whole team

Owners can tick Require two-factor sign-in for everyone on the team under System Settings, in Security. Anyone without it is asked to set it up the next time they open the dashboard, before they can do anything else. Turn it on for your own account first.

Where you are signed in

Your account lists every device signed in to your account, with when it signed in and when it was last used. Select Sign out next to any device you do not recognise, or Sign out all other devices. Changing your password signs out every other device too.

When a mail server is set up under Integrations, Auvyra emails you when:

Someone signs in to your account on a device it has not seen before
Your account has ten failed sign-ins in an hour
Someone enters your correct password but the wrong two-factor code three times, which means your password is probably known
A recovery code is used, or two-factor sign-in is turned on, turned off or reset

These emails cannot be turned off. Sign-ins, failed sign-ins and two-factor changes are also recorded in the activity history under System Settings, which owners can see.

Security checklist

System Settings has a Security section that lists what to fix, worst first:

How many people on the team use two-factor sign-in, and whether it is required
Team accounts nobody has used for 90 days, which are worth disabling
Whether AzuraCast is reached over HTTPS. Over plain http, its API key travels unencrypted.

What Auvyra does for you

Passwords are stored with Argon2id, and sessions as SHA-256 digests, so a copy of the database holds neither
Authenticator keys are encrypted with your ENCRYPTION_KEY, and recovery codes are stored only as digests keyed with it, so a copy of the database alone reveals neither. Keep your .env backed up: if ENCRYPTION_KEY changes, everyone's two-factor sign-in has to be reset.
Each code works once, and code guesses are limited per account, per address and per day
Sign-in attempts are limited, and a failed sign-in takes as long whether or not the account exists
Browsers are told to use HTTPS for your site once it is served over HTTPS, and pages cannot be framed by other sites