# Signing In and MFA


Primebrick protects your account in layers. This page explains what those
layers are — and why the app occasionally asks you to prove it's really
you *again*.

## The everyday sign-in

You sign in with your organization's identity provider — typically an email
and password. If your administrator has enabled it, you may also be asked
for a **second factor**: a 6-digit code from an authenticator app on your
phone (TOTP), or a **passkey** — the fingerprint, face scan or device PIN
your phone or computer already uses.

That second factor is what makes stolen passwords mostly useless: an
attacker who knows your password still can't produce the code living on
*your* device.

## "Why is it asking for my code again?"

Sensitive actions — things like deleting records in bulk, changing
permissions, or letting the assistant modify data — trigger a **step-up**
check: Primebrick asks for your authenticator code one more time, right
before the action happens.

This is deliberate. Your sign-in proves who sat down at the computer; the
step-up proves who's still sitting there *now*. If Jane Doe steps away for
coffee, nobody else can perform sensitive actions from her open session —
the code lives on her phone, not in the browser.

The confirmation is quick: the app shows what it's about to do, you type
the 6 digits, and the action proceeds. Each code authorizes that one
action — it can't be replayed for anything else.

## Managing your own credentials

From **Settings → Credentials** you can:

- register or remove a **passkey** (fingerprint / face / device PIN)
- set up or reset your **authenticator app** pairing (TOTP)
- see which sign-in methods are active on your account

If you lose your phone or your authenticator app, ask your administrator —
they can reset your second factor from the Users administration screen so
you can enroll a new device.

## What we recommend

- **Enable MFA if your organization offers it** — it's the single largest
  upgrade to your account's safety.
- **Prefer a passkey over codes** when your device supports it — same
  protection, less typing.
- **Never share your authenticator codes** — no admin or support person
  will ever legitimately ask for one.