Two-factor authentication & login security

basic

Protect your account — the login human-check, two-factor codes, recovery codes, and biometric passkeys.

Your Apolaris AI account is the front door to your organization's calendar, sales, customers, and reports. This page explains the protections that guard that door: the human-check you answer at every login, the optional second factor you can add for extra safety, and the recovery codes that get you back in if you lose your phone.

Who can do this: Any signed-in user can enable two-factor authentication on their own account from My profile → Security. It only affects your own login. Whether 2FA is required is a per-organization policy set by a manager or privilege administrator (see Organization 2FA policy).

Every sign-in shows a small arithmetic question — for example "What is 4 + 7?" — in a box labelled Verification. Type the answer (here, 11) before you select Sign in.

This is an offline check that stops automated scripts from hammering the login page. There is no external CAPTCHA service, nothing to click, and no images to decode.

The question changes on every attempt. If a sign-in fails, read and answer the new question that appears, not the old one.
Your password is not even checked until the verification passes. A blank or wrong answer shows "Verification failed. Please answer the question and try again."
There is also an invisible decoy field on the form. It looks empty and is meant to stay empty — a normal person never sees it. Just leave it blank.

If you are sure your password is right but keep failing, you may be answering with the old question still on screen. Reload the page to get a clean question, then answer that one.

If you get locked out

To slow down attackers, Apolaris AI counts failed sign-in attempts. After several failures in a short window — counted both for your account and for the device you're on — the login is temporarily locked and shows "Too many attempts. Please wait a few minutes and try again."

Stop trying and wait a few minutes. The lock clears on its own once the attempts stop.
Then sign in again with the correct password and a fresh verification answer.

You don't need an administrator to clear a throttle lock — it is time-based and self-clearing.

What two-factor authentication adds

Two-factor authentication (2FA) adds a second step after your password. Even if someone learns your password, they still can't get in without your second factor. After your password is accepted, you're sent to a challenge screen and must enter a current code before you reach the app.

You can enrol any of these second factors:

Method	What it is	Best for
Authenticator app (TOTP)	A 6-digit code that refreshes every 30 seconds in an app like Google Authenticator, Microsoft Authenticator, or Authy	The strongest, most reliable option — works with no signal
Email code	A 6-digit one-time code sent to your account email	A simple option when you can't install an app
SMS code	A 6-digit one-time code texted to your phone	A phone-based fallback (see the note below)
Push approval (Apolaris app)	Approve or deny the sign-in by tapping a notification on your phone — no code to type	The fastest sign-in once you've installed the app and enabled notifications

SMS availability: The SMS option only appears when your organization has the SMS module turned on and a messaging provider is configured. If you don't see SMS, it isn't available for your organization — that's expected, not a missing setting. Email codes are valid for 5 minutes once sent.

Turn on 2FA from your profile

Click your name or avatar in the top-right corner and open My profile.
Go to the Security section and select Two-factor authentication. This opens the setup page.
Choose a method and follow the steps below.

Add an authenticator app (recommended)

On the setup page, choose to add an Authenticator app.
Open your authenticator app and scan the QR code shown (or type the secret key manually).
Your app starts showing a 6-digit code. Type the current code into Apolaris AI and confirm.
(Optional) Give the device a label so you recognise it later, e.g. "My phone".

Once the code matches, the authenticator is active immediately.

Add an email code

On the setup page, choose to add an Email code. A code is sent to your account email straight away.
Open the email, copy the 6-digit code, and enter it on the confirmation screen.
If it doesn't arrive, use resend to get a new code, and check your spam folder.

Email codes require your account to have an email address on file. If it doesn't, set one first in My profile → Account.

Add an SMS code

On the setup page (only shown when SMS is available), choose SMS code and enter your phone number including the country code, e.g. +1 555 123 4567.
A code is texted to that number. Enter it on the confirmation screen to confirm.

Add push approval (Apolaris app)

If you use the Apolaris app on your phone with notifications enabled, you can approve sign-ins with a single tap instead of typing a code.

On the setup page, choose to add Push approval (Apolaris app). Apolaris sends a test notification to your phone straight away.
Open the notification and tap Approve. That confirms the device and turns push approval on.
From then on, whenever a sign-in needs your second factor, your phone gets a notification — tap Approve to continue or Deny to block it.

Push approval needs three things in place: the Apolaris app installed on your phone, notifications enabled on that device, and push configured for your organization by Apolaris. If any is missing, the push option simply doesn't appear — use an authenticator app, email, or SMS instead. A push request expires after about two minutes, and push currently works on one device at a time (enrolling a new phone replaces the old one). On iPhone, where notifications don't show Approve/Deny buttons, tapping the notification opens a quick in-app page where you approve. Approval prompts are delivered with high priority, so they reach a locked or dozing phone, and re-sending a prompt replaces the pending one instead of stacking a duplicate.

You can mix factors — for example an authenticator app as your main method plus email or push approval as a backup. The first one you confirm becomes your primary factor, offered first at the challenge; to change it later, use the Make primary button next to any confirmed method.

Remove a factor

From the same Security setup page you can remove any device you've enrolled. Removing your last confirmed factor turns 2FA off for your account — unless your organization requires it, in which case you'll be asked to enrol a new one.

Biometric sign-in (passkeys)

The same setup page hosts one more protection: Biometric sign-in (passkeys). A passkey lets you sign in with your fingerprint, face, or device PIN — no password to type — and because the device unlock is part of the sign-in, it also covers your two-factor step: a passkey sign-in never sees the challenge screen.

Register this device

On the 2FA setup page, find the Biometric sign-in (passkeys) section.
Select Set up this device and confirm with your fingerprint, face, or device PIN — Touch ID, Face ID, Windows Hello, and Android biometrics all work.
The passkey appears in the list straight away, and the sign-in screen on this device now offers Sign in with fingerprint or face (see Signing in).

If the device can't do it, the button is replaced by "This browser does not support biometric sign-in." If registration fails, you'll see "Could not set up the passkey. Please try again." — and registering a device that already holds a passkey is refused with "This device is already registered."

Manage your passkeys

Each passkey is listed with the date it was added; before you register any, the section shows "No passkeys yet."
A passkey belongs to the device — or to a platform account: iCloud Keychain or Google Password Manager may sync it across your own devices — so set one up on each device you use. You can keep up to 10 passkeys.
Select Remove next to a passkey to delete it (you'll be asked to confirm "Remove this passkey?"). Removal is instant and affects only that one passkey.
Lost a device? Remove its passkey here from any other device, or ask Apolaris support to revoke it for you.

You cannot add or remove passkeys while your current sign-in still owes its two-factor code — finish the verification first. This stops someone who only knows your password from registering a sign-in method that would bypass your 2FA.

Passwords keep working exactly as before — the passkey is an additional, faster way in, not a replacement. In the staff portal (Caja), the Fingerprint & security menu item (shown as Huella digital y seguridad) leads to this same page. Managers can read the organization-level view in Security & messaging.

Recovery codes

When you confirm your first second factor, Apolaris AI generates a one-time list of recovery codes and shows them to you once. Each looks like a1b2-c3d4.

Save your recovery codes immediately. They are shown only once and are not stored anywhere you can read them back — Apolaris AI keeps them hashed, not in plain text. Print them or store them in a password manager somewhere separate from your phone.

How recovery codes work:

Each code is single-use. Once you sign in with one, it is consumed and can't be used again.
You can enter a recovery code on the challenge screen anywhere you'd normally enter a 2FA code — useful when you've lost access to your phone.
You can regenerate the list at any time from the Security setup page. Regenerating replaces all unused codes with a fresh batch, so any old printout stops working.

Generate a fresh set after you've used a few, and keep at least a couple of unused codes in reserve. The setup page shows how many unused codes you have left.

At the challenge screen

When a session needs a second factor, every page redirects you to the challenge until you pass — you can't skip it. On that screen you can:

Enter the current code from your authenticator app, or
Enter the one-time code that was sent to your email or SMS (use the send a code action to dispatch a fresh one), or
Enter one of your recovery codes.

If you have more than one factor, you can pick which one to use. To prevent guessing, the challenge caps how many wrong codes you can try per session; after too many failures you'll be asked to wait, and any pending email/SMS code is invalidated so a new one must be sent.

Once you clear the challenge, the rest of your session works normally — you won't be asked again until you sign in fresh.

Signing in with a passkey skips the challenge entirely — the fingerprint or face confirmation already counts as your second factor. See Biometric sign-in (passkeys).

Your organization requires 2FA

Your manager or privilege administrator can set an organization-wide 2FA policy. There are three settings:

Policy	Who must use 2FA
Not required	No one is forced; 2FA stays optional and self-service
Required for managers & admins	Managers and privilege administrators must enrol; other staff remain optional
Required for all users	Everyone in the organization must enrol

If a policy applies to you and you haven't set up a second factor yet, signing in takes you straight to the setup page with a notice that 2FA is required. You must enrol before you can use the app.

Raising the policy takes effect on a user's very next request, not only at their next sign-in. If your administrator turns the requirement on while you're working, you'll be sent to set up 2FA the next time you load a page.

This is an organization policy, so it's documented for administrators on Users & privileges administration. Site visibility and other access are unaffected by 2FA — see Site visibility.

If you're locked out of 2FA

Lost your phone or can't get a code? Work through these in order:

Use a recovery code. Enter any unused recovery code on the challenge screen — it works in place of a device code.
Use another factor. If you enrolled more than one (e.g. email as well as an app), switch to the one you can still access.
Ask an administrator. If you've lost both your second factor and your recovery codes, a manager or privilege administrator has to help you regain access. There is no self-service way back in once both are gone.

Losing your only second factor and all your recovery codes locks you out until an administrator intervenes. This is exactly why you save the recovery codes the day you turn 2FA on.

A note for scripts and integrations

Don't drive Apolaris AI with your personal login from a script — it has to pass the verification question and, where enabled, the 2FA challenge, and a script can't answer either. Create a dedicated API token instead, which authenticates by bearer key and skips the browser login entirely. See Your profile to mint one and the REST API overview for how to use it.