Skip to main content
Two-step verification adds a 6-digit code between signing in (password, Google, Microsoft and the like) and getting into Pria. People choose their second step in their profile’s Two-step verification section: email codes, an authenticator app (Google Authenticator, 1Password and similar apps, whose codes change every 30 seconds), or both. Setting up an authenticator app also gives a set of one-time backup codes. It is turned on person by person.
MFA is enabled at the platform level. If the two-step verification options described here don’t appear in your deployment, contact the Praxis AI team at humans@praxis-ai.com.

​
Who is asked to turn it on

People without two-step verification may see Strengthen your account security after they sign in: The screen never appears while you use Act As. You can also turn it on for someone yourself — see Managing MFA per person. For admins in Canvas, see More security for Canvas login.

​
How signing in works with MFA

  • Email codes are valid for 5 minutes. Inside Canvas, the code is emailed when the person selects Send me a code.
  • People with an authenticator app type its current code instead; from the code screen they can switch to a backup code, or to an email code when that is also on.
  • Trusted browsers. After a correct code, the browser is trusted for 7 days — as long as it comes from the same network (the same public address block; a phone that moves between networks is asked again). Inside Canvas, a verified browser is remembered for 24 hours, for that Digital Twin and network. People can sign out their own trusted browsers from their profile (Studio UI: Security › Trusted devices › Sign out trusted devices); changing their password does it too.
  • Backup codes work once each, for when the app is not available.

​
Managing MFA per person

Open Admin → Users, select the person, then the Security tab. Under Two-step verification:
  • Require email MFA for this user — turns two-step verification on (email codes; the person can add an authenticator app in their profile) or off; save to apply. Turning it off also resets their authenticator app and backup codes and signs out their trusted browsers, so a person who lost everything can set it up again cleanly.
  • Enabled <date> — shown when an admin turned it on here.
  • Revoke trusted devices — every browser they verified must enter a code again at the next sign-in.
Turning MFA off does not sign the person out. Their current sign-in stays valid until it ends (about six hours after they stop using Pria); their next sign-in goes through without a code. To sign them out now, set a new password for them — that signs them out everywhere and signs out their trusted browsers.

​
When to turn a person’s MFA off

  • They are locked out: lost access to their email, or lost their authenticator app and their backup codes.
  • A security incident requires reducing friction so they can recover their account.
  • A standard user turned it on and changed their mind.

​
When to revoke trusted devices

  • They reported a device lost or stolen.
  • They used a shared or public computer.
  • After a suspected password leak (together with a password reset).

​
Protection against guessing

  1. Per code: 5 tries. After 5 wrong entries the code stops working and the person asks for a new one (Resend, at most once every 30 seconds).
  2. Per way of signing in: 10 failed codes in an hour, or 20 in a day. Past that, that way of signing in — from a Canvas course, with email and password, or any other — waits until the hour or day is over, and Pria says how long. The other ways stay open, so someone who keeps failing codes from a course launch cannot lock the person out of their own password sign-in. A correct code resets the count.
  3. Codes sent from a course launch: at most 5 an hour from one network and 15 an hour per person.
To let a waiting person in at once, select Revoke trusted devices — it clears the count.

​
Sign-ins that skip the code

  • Launches from Canvas when the Digital Twin uses Authenticate with Canvas on SDK login — that sign-in counts as the second step. Without it, a launch goes through the same check as any other sign-in for someone with MFA on; see More security for Canvas login.
  • API-key sign-ins — the key itself is a strong credential, meant for server-to-server use.
Sign-ins with a password, Google, Microsoft, GitHub, Facebook, Apple or your organisation’s single sign-on all ask for a code when the person has MFA on.

​
Audit trail

MFA events — turning it on or off, codes sent and checked, lockouts, trusted browsers added or revoked — are recorded. There is no screen for them; for an extract for a security review, contact the Praxis AI team at humans@praxis-ai.com.

​
Frequently asked questions

Not for everyone at once — it is turned on person by person. Admins are asked to turn it on themselves (see Who is asked to turn it on), and you can turn it on for anyone under Admin → Users → Security.
Their current sign-in stays valid until it ends (about six hours after they stop using Pria) and their trusted browsers are signed out. They keep working, then sign in again without a code. To sign them out at once, set a new password for them.
Yes. On an iPhone, Safari offers the 6-digit code from the Mail app above the keyboard — one tap fills it in. Android browsers offer similar suggestions.
Setting up an authenticator app creates one-time backup codes, shown once with a download option. Each works exactly once in place of the app. If someone has used up the app and every backup code, turn their MFA off under Security (this resets the app) and have them set it up again. If no other admin is available, contact the Praxis AI team at humans@praxis-ai.com.
Any standard app — Google Authenticator, 1Password, Authy and the like. People set it up in their profile’s Two-step verification section by scanning a QR code or typing the setup key, then confirming with a live code (in the Studio UI, under Settings › Security › Secure your account, with the setup key and an Open in authenticator app link). Once set up, the app is the first choice at sign-in. Passkeys are not supported yet.