> ## Documentation Index > Fetch the complete documentation index at: https://docs.tilt.now/llms.txt > Use this file to discover all available pages before exploring further. # Require a passkey or two-step sign-in for your firm > Make everyone in your firm sign in with a passkey, enter a two-step code, or both. See who isn't set up yet, and reset a member's methods after a lost device. Your firm can ask for more than the usual sign-in. These rules apply to your firm only: each member's personal workspace and their other organizations sign in as before. | Rule | What members do | | - | - | | **Require a passkey** | Sign in to the firm with a passkey: Touch ID, Face ID, or the device's PIN. A passkey works only on Tilt's own site, so a fake sign-in page can't use it. | | **Require two-step sign-in** | After signing in, also enter a code from a method the firm allows: an authenticator app, a text message, or either. | With both rules on, members do both: they sign in with a passkey and also enter a two-step code. A passkey is a way to sign in, so it never counts as the two-step code. Every firm starts with both rules off. Only an organization owner can change them, and the owner passes the same check before Tilt saves a new rule, so the owner can't lock themselves out. ## 1. Choose the rules Open **Settings > Security** in your firm. **Security** appears under **Organization** in the Settings menu. Members who aren't owners see each rule read-only, with **Only an organization owner can change this.** * To require a passkey, check **Require a passkey to sign in to this firm (Touch ID, Face ID or a PIN)** under **How members sign in**. * To require two-step sign-in, check **Require two-step sign-in** under **Two-step sign-in**, then choose the **Allowed methods**: **Authenticator app**, **Text message**, or both. Tilt starts with **Authenticator app**, and at least one method stays checked. Text messages are the weaker method. Someone who talks a phone carrier into moving a member's number to their own SIM card gets that member's codes, so prefer an authenticator app and allow text messages only when members need them. Tilt texts codes to US, Canadian and UK mobile numbers. ![How members sign in, with Require a passkey to sign in to this firm (Touch ID, Face ID or a PIN) unchecked. Two-step sign-in, with Require two-step sign-in checked and the allowed methods Authenticator app and Text message both checked; Text message reads Weaker: a stolen phone number gets the codes. Ask members again is set to After the inactivity logout. A line reads 4 members aren't set up yet, and the open list shows four blurred emails, each with Needs a two-step method. A Save changes button sits below.](https://mintcdn.com/tilt/6xkyJibTs_pja0DA/images/advisor/security-sign-in-rules-owner.jpg?fit=max\&auto=format\&n=6xkyJibTs_pja0DA\&q=85\&s=15b06faadd2b23c82a0fc034012ce8b2) An owner turning on two-step sign-in for a demo firm, Maple Ridge Advisors, before saving, with See who open. Test-account emails are blurred. ### Ask members again **Ask members again** sets how long a member's passkey or two-step check counts before the firm asks for it again. It covers both rules. | Choice | The firm asks again | | - | - | | **After the inactivity logout** | When the firm's [inactivity logout](https://docs.tilt.now/advisor/inactivity-logout.md) signs the member out. | | **Every 24 hours** | A day after the member's last check, or after the inactivity logout, whichever comes first. | | **Every 7 days** | A week after the member's last check, or after the inactivity logout, whichever comes first. | Coming back after the inactivity logout always asks again. While the inactivity logout is **Off**, **After the inactivity logout** isn't offered, so choose **Every 24 hours** or **Every 7 days**. Each sign-in has its own checks. A member who signs in on a second browser, or in [Tilt for Mac](https://docs.tilt.now/tilt-agent/tilt-for-mac.md), confirms it's them there too. ### See who isn't set up yet While either rule is checked, the page counts the members who don't have what the rules on the page need, for example **4 members aren't set up yet**. Select **See who** to list them by email, each with what they need: **Needs a passkey**, **Needs a two-step method**, or both. The count follows the page as you change the rules, so you see who a change affects before you save it. **Every member is set up.** means nobody is missing anything. Only methods set up for this firm count. The first time a rule goes on, every member shows as not set up, you included. ## 2. Confirm it's you and save Select **Save changes**. Before Tilt saves a rule you're turning on, or a change to the allowed methods, it asks you to pass a check the new rule accepts, for this firm, in the last 10 minutes. The page runs the check in place: * **Require a passkey:** add a passkey for the firm with **Add a passkey**, or use the one you have. * **Require two-step sign-in:** set up an allowed method for the firm with **Set up an authenticator app** or **Set up text message codes**, or enter a code from the one you have. Your first method for the firm starts with a code Tilt emails you. Once the check passes, Tilt saves your settings. Turning a rule off, or changing only **Ask members again**, needs no check. Each save adds a **Changed settings** entry to the firm's History, with the old and new value of each setting and the owner who saved it. Select **Open History** on the Security page to see it. ## What members see The next time a member opens the firm, Tilt shows the firm's sign-in page instead. It asks them to add a passkey or set up two-step sign-in for the firm, starting with a code Tilt emails them, or to confirm it's them with a method they already set up. Right after they sign in to Tilt, the same page asks for the firm, with **Not now** to skip it until they open the firm. [Sign in to a firm that requires a passkey or two-step sign-in](https://docs.tilt.now/advisor/sign-in-with-passkey-or-two-step.md) walks members through it. Methods belong to one person in one firm. A member's authenticator app, phone and passkeys for your firm never count at another firm, and theirs from another firm never count at yours. When you turn a rule off or stop allowing a method, members keep the methods they set up. They can remove them in **Settings > Sign-in methods**. If you turn the rule back on, those methods count again. ## Reset a member's lost device While your firm requires a passkey or two-step sign-in, or members still have methods for it, **Members' sign-in methods** on the Security page lists each member's passkeys and two-step methods for your firm: the kind of method, a passkey's name, when it was added and last used, and the last two digits of a phone. A member without what the rules need shows **Not set up**. Methods a member set up for another organization never show here. To reset a member who lost their device: 1. Select **Reset** beside the member. 2. Read the dialog and select **Reset**. If you haven't confirmed it's you in the last 10 minutes, Tilt asks first: with a code from your email when the firm requires neither rule, otherwise with your own method for the firm. The reset removes the member's sign-in methods for your firm only. Their sign-in to other organizations doesn't change. Tilt emails them about it, and the firm's History records **Reset a member's sign-in methods**. While the firm requires a passkey or two-step sign-in, they set up a method again the next time they open it, starting with an emailed code. ![Members' sign-in methods for Maple Ridge Advisors. Two members show a Not set up badge and No sign-in methods set up yet. One member's row reads Two-step: Authenticator app, added Oct 28, 2026, last used Oct 28, 2026, with a Reset button. The owner's own row has an Owner badge, the same kind of authenticator app line, and no Reset button.](https://mintcdn.com/tilt/6xkyJibTs_pja0DA/images/advisor/security-members-sign-in-methods.jpg?fit=max\&auto=format\&n=6xkyJibTs_pja0DA\&q=85\&s=6ef5040327d71f593e7ad8876be2d723) Members' sign-in methods in Maple Ridge Advisors. Test-account emails are blurred. A member who still has another method for your firm can remove the lost one themselves in **Settings > Sign-in methods**. ## If you're the firm's only owner You can't reset your own methods. Another owner of your firm can. If you're the only owner and you've lost the device with your methods, contact Tilt support. Tilt support resets your methods for this firm only, the firm's History shows **Tilt support** as who made the reset, and Tilt emails you about it. ## API keys, connected apps and Tilt Agent The rules apply to people signed in to Tilt. These keep working in the firm whether or not a member meets the rules: * Requests made with a Tilt API key. * Apps already connected to Tilt, such as Claude or ChatGPT. * Automations and other [background jobs](https://docs.tilt.now/tilt-agent/background-jobs.md). * Tilt Agent replies that had already started. Creating a Tilt API key for the firm, or connecting a new app to it, needs a sign-in that meets the firm's rules. So does opening the firm in Tilt to start a new chat. ## Ask Tilt Agent Tilt Agent reads your firm's rules and explains them. For an owner, it also says how many members aren't set up yet; it never says who, and it never reads anyone's methods. Ask, for example, **"Does our firm require two-step sign-in?"** or **"How many people still need to set up two-step sign-in?"** Tilt Agent never changes these settings itself. Ask it to turn a rule on or off, or to change the allowed methods or **Ask members again**, and it prepares a review card with the current and new value of each setting. Nothing changes until an owner applies the card in Tilt, in the firm. Applying a card that turns a rule on needs the same check from the last 10 minutes; without one, Tilt refuses it, and **Settings > Security** asks for the check and saves the same change. Tilt Agent never resets a member's methods. Never paste a sign-in, authenticator app, or text message code into chat. Enter codes only on Tilt's own screens. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.