Account security
How you prove it is you: passkeys, authenticator apps, recovery codes, and the devices you trust.
Your account settings live at Settings → Security. This page covers how you sign in and how to keep that under your control.
How you sign in
Superposition supports two ways to sign in, and you can use both on the same account:
- Google — the account you already have. Nothing to set up.
- Email and password — passwords are checked against known breach corpora when you set them, so a password that has appeared in a public breach is rejected. The check uses a k-anonymity range API, so your password is never sent anywhere.
Signing in is only the first factor. Everything below is the second.
Two-factor authentication
A second factor means a stolen password is not enough to reach your account. Two methods are available, and they are not equals:
| Method | What it is | Strength |
|---|---|---|
| Passkey | Face ID, Touch ID, or a hardware security key | Strongest. Satisfies both factors in one step |
| Authenticator app | Six-digit TOTP codes from an app on your phone | Strong. Works with no signal |
There is deliberately no email option. A code sent to your mailbox does not survive the mailbox compromise it exists to prevent.
Adding a passkey
- Open Settings → Security.
- Next to Passkey, select Add.
- Confirm with your device: Face ID, Touch ID, Windows Hello, or a security key.
A passkey signs you in and satisfies your second factor in one step, so you are not asked for a code afterwards. Passkeys stored in a password manager or platform keychain sync across your devices; a hardware key does not, and is marked accordingly in the list.
Passkeys are bound to the exact domain they were created on, so a passkey created on
app.superposition.ai works only there.
You can rename a passkey at any time. This matters more than it sounds: the default name comes from the authenticator itself, so two credentials from the same provider show up as two identical rows, and then the only safe action on either is none.
Setting up an authenticator app
- Open Settings → Security.
- Next to Authenticator app, select Set up.
- Confirm it is you.
- Scan the QR code with your authenticator app, or enter the key by hand.
- Enter the six-digit code to confirm the app is working.
- Save your recovery codes. This is the only time they are shown.
Two-factor is not switched on until step 5 passes, so abandoning this halfway leaves nothing half-enabled.
Recovery codes
Recovery codes are single-use codes that get you back in when you lose your phone. You get a set when you enable an authenticator app.
- Each code works once.
- Signing in with a recovery code lands you on this page rather than the dashboard, so you can replace the code you just spent.
- Generating a new set invalidates every existing code. If you saved them somewhere, replace that copy.
A warning appears once you are running low.
Store recovery codes somewhere you can reach without your phone. A screenshot in the photo library on the phone you lost is not a recovery plan.
Trusted devices
When you tick Trust this device while answering a challenge, that browser skips the second-factor prompt for 30 days. Signing in with a passkey trusts the device automatically, since you have just proven possession of the credential.
Settings → Security → Trusted devices lists every device you have remembered, with where it was last used and when the trust lapses. The device you are reading on is labelled, so you do not revoke it by accident.
Select Forget on any device, or Revoke all to clear the list. Trust is also cleared automatically whenever you change your factors: a device trusted under your old setup must not keep skipping a challenge it should now face.
Confirming it is you
Changing your security settings asks you to confirm your identity first, even though you are already signed in. This is what stops a borrowed or hijacked session from quietly stripping your account's protections. GitHub, Vercel, and Stripe all work this way.
You can confirm with whichever of these you have: your password, a code from your authenticator app, or your passkey. If you sign in with Google and have no password, use one of the other two.
One confirmation opens a short window, so changing several things in a row asks once rather than at every click. The window ends early after a destructive change.
If your organization requires two-factor
Admins can require a second factor for everyone in the organization. If yours does and you have not set one up, you are held at an enrollment screen on your next sign-in, with the organization asking named on it.
There is no grace period, and it is not only the dashboard that is held: the requirement is enforced everywhere, including the API and agent surfaces. Adding a passkey or an authenticator app clears it immediately.
Next steps
- Admins: Organization security
- Building against the API: Authentication
Last updated on