Skip to content
Pathwatch Docs

Account security

PathWatch supports password + 2FA, passkey, and OAuth sign-in. All account-security settings live under Settings → Security in the WebUI.

Passwords

The default sign-in method is email + password. Passwords are hashed with bcrypt at rest. Minimum length 8 chars.

Forgot-password issues a one-time reset link valid for 1 hour. The link expires on use even if it hasn’t been clicked yet — taking a new reset invalidates any previous link.

Two-factor authentication (TOTP)

Enable at Settings → Security → Enable two-factor authentication.

  1. Scan the QR code with an authenticator app (Authy, 1Password, Google Authenticator, etc.).
  2. Enter the 6-digit code to confirm setup.
  3. Save the backup codes shown after activation. They’re each single-use; we don’t store them in a recoverable form.

Once enabled, sign-in asks for the 6-digit code after password. Lost your authenticator? Use a backup code from the list above. Lost both? Contact support — recovery requires identity verification and is intentionally slow.

Passkeys

Passkeys (WebAuthn) are passwordless and phishing-resistant. Register one at Settings → Security → Add passkey.

After saving a passkey:

  • Sign-in shows a Sign in with passkey button on the sign-in page.
  • Touch-ID / Windows Hello / Face-ID / hardware key prompts you to authenticate.
  • No password or 2FA code needed.

You can register multiple passkeys per account (recommended — one per device). Removing a passkey is immediate; the next sign-in attempt with it returns “no such credential”.

Passkeys do not replace 2FA on the password path. If you have both 2FA and passkeys, the passkey path skips both password and TOTP; the password path still asks for TOTP.

Social sign-in

Sign in with:

  • Google
  • GitHub

Magic-link sign-in is also available — request a one-time link to your verified email from the sign-in page.

Users who only sign in via a social provider don’t have a local password. To sign in without the OAuth provider later, set a password from Settings → Account, or register a passkey.

SSO (SAML / SCIM)

Single Sign-On via SAML and user provisioning via SCIM are Business plan features. Configure them in Settings → SSO — the page walks you through metadata exchange with your IdP and the SCIM endpoint URL + bearer token.

Users provisioned via SCIM cannot set a local password; they sign in through your IdP only. Removing them from the IdP group auto-deactivates the PathWatch user via the SCIM lifecycle hook.

Organisation-wide policies

Org admins on Pro and above can require security controls across all members — see Security policies. Members who don’t meet the policy are blocked at the next sign-in until they configure the required factor.

Sessions

The session list at Settings → Security → Active sessions shows every signed-in browser. Each row has device fingerprint, location, last-active timestamp, and a Revoke button.

Revoking a session forces that browser to re-sign-in on next request. Revoke remote sessions if you sign in from a public machine and forget to sign out, or if you suspect a credential compromise.