Two-Factor Authentication & Passkeys
Guardian supports two second-factor methods, available on every plan (unlike Enterprise SSO and LDAP/AD, which are Enterprise-tier): a standard TOTP authenticator app, and passkeys (WebAuthn) — a phishing-resistant alternative using your device’s fingerprint, face, or a hardware security key.
Authenticator app (TOTP)
Section titled “Authenticator app (TOTP)”Set up automatically the first time you sign in after 2FA is required for your account (either because a Superadmin turned on ENFORCE_2FA for your tenant, or because you’ve enabled it for yourself). The login screen shows a QR code — scan it with Google Authenticator, Authy, or any standard TOTP app — and a manual entry key as a fallback if you can’t scan.
From then on, every login asks for the 6-digit code from your app.
Passkeys
Section titled “Passkeys”A passkey replaces the 6-digit code with your device’s own fingerprint, face unlock, or a hardware key (YubiKey and similar) — nothing to type, and it can’t be phished the way a password or a copied code can.
Adding a passkey
Section titled “Adding a passkey”You need to already be signed in — a passkey is added to an account you can already access, not used to create one.
- Go to Settings → My Passkeys.
- Click + Add Passkey and follow your browser/OS prompt (Touch ID, Windows Hello, a security key, etc.).
- Give it a name if you manage several (e.g. “Work laptop”, “YubiKey”).
Signing in with a passkey
Section titled “Signing in with a passkey”If your account has at least one passkey registered, the login screen shows a Use a passkey instead option alongside the authenticator code field once you’ve entered your password. Click it and complete your browser/OS prompt — no code to type.
Removing a passkey
Section titled “Removing a passkey”Settings → My Passkeys → Remove next to the one you want to revoke. Do this immediately if a device with a passkey on it is lost or stolen.
Which one to use
Section titled “Which one to use”Both are supported side by side — you’re not limited to one. Passkeys are the stronger option where your device supports them (most phones and laptops from the last few years); keep an authenticator app as a fallback if you use a shared or older device.