Sign-in and two-factor authentication

Every sign-in to the Blink console needs a password and a second factor: a passkey, or a 6-digit code from an authenticator app. Two-factor authentication is always on and can’t be turned off. Anyone who hasn’t set it up yet is asked to at their next sign-in.

You manage your own sign-in on the Account page, under You in the console sidebar.

Set up two-factor authentication

You set up two-factor when you first sign in from an invite link, or after an instance owner resets your sign-in.

1. On the Set up two-factor screen, add the key to an authenticator app such as Google Authenticator, 1Password or Authy. Select Open in authenticator, or select Copy key and paste the Setup key into the app.
2. Enter the 6-digit code the app shows.
3. Select Verify and enable.
4. Blink shows your recovery codes. Save them somewhere safe, then select I’ve saved them, continue.

Recovery codes

You get 10 recovery codes. Each one works once, in place of a 6-digit code, if you lose your authenticator app. The Account page shows how many you have left.

To get a new set:

1. Open Account.
2. Under Two-factor authentication, select New recovery codes.
3. Enter the 6-digit code from your authenticator app and select Make new codes.
4. Save the new codes, then select I’ve saved them.

Your old codes stop working, and the new ones are not shown again.

Passkeys

A passkey lets you sign in and confirm high-risk actions with your fingerprint, face, screen lock or a security key instead of typing a code. Passkeys can’t be phished. Your authenticator app stays as the fallback.

To add a passkey:

1. Open Account.
2. Under Passkeys, select Add passkey.
3. Enter a Name, for example the name of the laptop or security key, and select Continue.
4. Follow your browser’s prompt.

To remove a passkey, select the bin icon next to it. When you sign in with a passkey available, you can still choose Use a code from your authenticator app instead.

Sign out everywhere

If you think a computer or phone you used was lost or stolen, open Account and select Sign out of all devices. Sign out signs out only the browser you are using.

Lost authenticator or forgotten password

Users can’t change their own password or remove two-factor in the console. If you have no recovery codes left, or forgot your password, ask an instance owner to reset your sign-in. They send you a new link to choose a password and set up two-factor again. See Reset a user’s sign-in.

How long a sign-in lasts

A console sign-in lasts 30 days by default. After that, the browser has to sign in again with password and second factor, however active it was. Someone with the Manage security settings permission can change this to anything from 1 to 365 days. See Sign-in lifetime.

Confirming high-risk actions

Some actions ask for a fresh passkey or 6-digit code even though you are signed in, so a stolen sign-in alone can’t do them. These include opening a terminal, Backstage tools as SYSTEM, a Safe Mode reboot, Install Access, changes to roles, members, users and two-factor, changes to security settings, revoking or deleting a device, and changes to the instance identity and keys.

How long one confirmation lasts is an instance setting. See Confirming high-risk actions.

Too many wrong attempts

Blink limits wrong passwords and wrong two-factor codes. Too many wrong codes for one account lock that account for a while, from every address except allowlisted ones. Too many wrong passwords lock that email from that address only, so nobody can lock you out from somewhere else. See Rate limits.