Security & messaging (2FA policy & SMS)

The Configuration page (/configuration/) is where you manage two organization-wide security and messaging controls in one place:

• Two-factor authentication (2FA) — your personal second-factor methods, plus the organization-wide policy that can require everyone (or just managers) to enrol.
• SMS text messaging — the status of your text-message provider and a test send. SMS powers 2FA codes sent by text and, when a user opts in, notification delivery.

This page is part of the administration cluster. For per-organization branding, language and number format, see Organization settings. For user accounts and the privileges referenced below, see Users & privileges.

Who can do this

Access is granular per privilege. There are no fixed "role names" — a manager (is_manager) always passes, and a non-manager needs the specific privilege.

Action	Who can do it
Open the Configuration page	Manager, or a user with the manage settings privilege (can_manage_settings)
Set the organization 2FA policy	Manager, or a privilege admin (can_manage_privileges, i.e. can_admin_privileges())
Enrol / manage your own 2FA methods	Any signed-in user
Configure the SMS provider credentials	Apolaris (platform operator) only
Send a test SMS	Apolaris (platform operator) only, and only when the SMS module is on

Two-factor authentication

Two-factor authentication adds a second step at sign-in — an authenticator app, an email code, an SMS code, or a one-tap push approval in the Apolaris mobile app — on top of the password. Even if a password leaks, an attacker still cannot get in without the second factor. For the full set of methods and how each user enrols (including push approval and choosing a primary method), see Two-factor authentication & login security.

Enrol your own account

Every signed-in user can turn on 2FA for their own account, regardless of any organization policy.

1. Open Configuration.
2. In the Two-factor authentication card, look at the status pill: it reads Enabled on your account or Not set up on your account.
3. Click Manage my two-factor methods to open the setup flow and add a method.

Once you have a confirmed second factor, every new sign-in prompts you for it before you reach the app.

Set the organization policy

The organization policy decides whether your team must use 2FA. Choose one of three options in the Organization policy section:

Policy	Code value	Who must enrol
Not required	off	Nobody — two-factor stays optional and each user decides.
Required for managers & admins	managers	Managers, privilege admins, and platform staff.
Required for all users	all	Every user in the organization.

To change it:

1. Open Configuration (you must be a manager or a privilege admin).
2. In the Two-factor authentication card, find Organization policy.
3. Select an option and click Save policy.

The card also shows a live count — "X of Y users have two-factor enabled" — so you can track adoption.

How "managers & admins" is decided

When the policy is Required for managers & admins, a user is "in scope" if any of these are true:

• They are a manager (is_manager).
• They are a privilege admin (can_admin_privileges(), i.e. they have can_manage_privileges).
• They are Apolaris platform staff.

Everyone else is left optional under this policy.

How users get prompted to enrol

Enforcement happens at the request level, not only at sign-in:

• A user who already has a confirmed second factor is challenged for it on every session that hasn't yet cleared 2FA.
• A user who has no second factor but is in scope for the policy is redirected to the 2FA setup screen and cannot use the rest of the app until they enrol.
• A user not in scope passes through normally.

Social sign-in

Social sign-in lets your team sign in with Google, Facebook or Apple instead of typing a password. You decide, per organization, which of these buttons appear on the sign-in page. For what the end-user experience looks like, see Signing in — this section is only about turning the providers on or off.

Turn a provider on or off

1. Open Configuration (the Advanced settings page at /configuration/). You must be a manager or a privilege admin to make changes.
2. Find the Social sign-in card.
3. Each provider — Google, Facebook, Apple — has its own switch. Toggle the ones you want and click Save sign-in options.

If you are not a manager or privilege admin, the card is read-only: each provider shows an Enabled or Off pill and a note that "Only a privilege admin or manager can change these."

Two switches must both be on

A provider button only appears once both of these are true:

• Apolaris has configured the provider at the platform level (the OAuth credentials live with us, never on your settings page).
• Your organization has toggled it on in the Social sign-in card.

If a provider is not set up at the platform level yet, its row shows a Pending setup tag. You can still switch it on now — no button will appear until Apolaris completes the platform-side setup, at which point your choice takes effect automatically.

Enabling a provider does not let strangers in

This is the important security rule: a social login only succeeds when the email on the provider account exactly matches an existing, active Apolaris user, and that user's own organization has the provider enabled.

• A social sign-in never creates a new account. Someone signing in with a Google address that doesn't match any Apolaris user is shown a page to contact our sales team — they do not get into your organization.
• The match is on the verified email, so turning on "Sign in with Google" simply gives your existing team a faster way in. It does not open the door to anyone with a Google account.

Biometric sign-in (passkeys)

Anyone can sign in with their fingerprint, face, or device PIN instead of typing a password, on any device that supports it (phones, Windows Hello laptops, Macs with Touch ID).

Setting it up

1. Open Profile → Two-factor authentication (in the staff portal: Profile → Fingerprint & security).
2. Under Biometric sign-in (passkeys), choose Set up this device and confirm with your fingerprint, face, or device PIN.
3. From then on, the sign-in screen offers Sign in with fingerprint or face — one tap, no password to type.

Good to know

• A passkey belongs to the device (or to a platform account — iCloud Keychain or Google Password Manager may sync it across a person's own devices). Set one up on each device you use.
• The device unlock is part of the sign-in, so a passkey also covers the two-factor step — no extra code is requested.
• Lost a device? Remove its passkey on that same page, or ask Apolaris support to revoke it.
• Passwords keep working exactly as before; the passkey is an additional, faster way in.

Automatic sign-out of idle sessions

To protect shared front-desk and POS/portal terminals, Apolaris signs a user out automatically after a period of inactivity — by default about 2 hours. This keeps an unattended till or reception screen from being left open on someone else's account.

What your team sees

• Shortly before the limit, a countdown warning appears — "Are you still there?" — with Stay signed in and Log out now.
• Clicking Stay signed in, or simply carrying on (navigating, clicking through the app), resets the clock. Leaving the screen untouched does not — a terminal nobody is using still times out, which is the whole point on a shared device.
• If the session does expire, the next action returns the user to the sign-in screen with a clear "You were signed out due to inactivity" message, shown in English, Spanish, or French.
• It applies to both the main app and the staff portal ("Caja"), and stays in sync across browser tabs.

SMS text messaging

SMS is used for two things:

1. Two-factor codes sent by text message.
2. Notification delivery — but only for users who opt in and add their own mobile number from their profile.

Nothing is sent by text until the provider is configured and a user has opted in.

Notification texts are deliberately reserved for a handful of time-critical alerts (system alerts, customer complaints, booking cancellations, contact center, camera alerts) and follow this same SMS configuration — see Notifications for the exact list and the per-user toggles.

How the provider is configured

The SMS provider and its credentials are configured by Apolaris (the platform operator), not inside your organization's settings. This is deliberate: the secret API token never appears on the app-facing Configuration page.

On the Configuration page, the SMS text messaging card shows:

• A status pill: Provider configured or Not configured.
• When configured, the sender number messages are sent from.

Test send (platform operator)

When the SMS module is on, a Send a test message form is available to the Apolaris platform operator. Enter a recipient number in E.164 format (for example +15551234567) and click Send test SMS. The result is reported inline:

• If the provider is not configured yet, you're told it needs to be set up first (Apolaris handles this).
• If the credentials are wrong, you are told the test could not be sent.
• On success, you get a confirmation that the test message was delivered.

Letting team members receive SMS notifications

Each team member controls their own SMS notifications:

1. The team member opens their profile.
2. They turn on SMS notifications and enter their own mobile number.

Until they do this, they receive no notification texts even when the provider is configured.

Cross-data impacts

• Tightening the 2FA policy is immediate. Switching to Required for all users can interrupt active sessions on the next request. Coordinate the change so staff are not locked at the setup screen mid-shift.
• SMS depends on two switches. A text only goes out when (a) the SMS module is enabled and the provider is configured by Apolaris, and (b) the user has opted in with their own number. A green "Provider configured" pill does not mean a specific user will receive texts — they still need to opt in.
• 2FA and SMS are linked. SMS codes are one of the 2FA delivery methods. If you rely on SMS codes for your team and the provider goes unconfigured, those users fall back to authenticator-app or email codes.

Related pages

• Users & privileges — who is a manager, and how to grant the privilege-admin role.
• Organization settings — branding, language and number format for your organization.
• Profile — where each user opts into SMS notifications and sets their number.
• Signing in — the day-to-day sign-in flow, including the second-factor step.