Account

Sign-in & security

How you sign in to VeriRun Lab, the second step that protects your account, and what we keep about it.

Your second sign-in step

A password can leak. A second step means a leaked password alone cannot open your account. You can use either of these, or both:

A passkey — your device's fingerprint, face or PIN. Nothing to type and nothing to copy. Passkeys work on current phones and computers, and on security keys.
An authenticator app — a six-digit code from an app such as Google Authenticator, Microsoft Authenticator or 1Password.

Add them under Settings → Sign-in & security. On an account with no second step yet, your first passkey is confirmed with your account password.

Once your account has a second step, signing in with your password opens nothing until you pass it: the app takes you to the second step, offers your passkey first and the code field below it. Administrators must have a second step; for everyone else it is optional, and we recommend it.

Signing in with a passkey alone

On the sign-in page, choose Sign in with a passkey — or pick your passkey from the email field's suggestions where your browser offers them. The passkey proves it is really you, so it replaces both the password and the second step.

Confirming it's you

A few actions ask you to confirm it's you first: approving a strategy brief or a version, approving data spend, administrator actions, and creating or changing an agent access token. One touch of your passkey does it; a code from your authenticator app, or a recovery code, works too. A confirmation lasts about ten minutes.

What we store

For a passkey, we store a public key and the name you gave it — your fingerprint or face never leaves your device, and we never see it. The matching private key stays on your device (or in your password manager, if it syncs your passkeys). We also keep when each passkey was added and last used, and whether it is synced across your devices, so you can tell them apart. Passkeys use the WebAuthn standard, built into every current browser.

For an authenticator app we keep its secret encrypted. Recovery codes are kept only as one-way fingerprints — we cannot show them to you again, which is why you see them once.

Recovery codes, and losing a device

When your account gets its first second step you receive ten single-use recovery codes, shown once. Each one works once in place of a passkey or a code — keep them somewhere safe, away from your devices. You can make a new set under Settings → Sign-in & security; making new ones ends the old set. The codes stay while your account has any second step and go with the last one.

Lost a device? Sign in with another passkey, your authenticator app or a recovery code, then remove the lost passkey under Settings → Sign-in & security. Lost all of them? Contact whoever administers your VeriRun Lab instance — they will confirm it is really you before clearing your second steps, so you can add new ones.

Where you are signed in

Settings → Sign-in & security lists every browser signed in to your account and how each one passed its second step: passkey, authenticator code, recovery code, or password only.

Agents and your sign-in

An agent you connect with an access token can read how your account signs in — which kinds of second step you have, how many passkeys, how many recovery codes are left — but never a passkey's name, a code, or anything it could use to sign in as you. An agent cannot add or remove a passkey: that is done by you, at your device. See External agents (MCP).