Your Atlazi account holds your trips, travellers and documents, so it is worth protecting well. This article covers the security tools built into your account and how sign-in actually works under the hood.
The short version: turn on two-step verification, use a strong password, and know that your session is kept out of reach of page scripts by design.
Two-step verification
Two-step verification, also called two-factor authentication or 2FA, adds a second check at sign-in: a code from your authenticator app, on top of your password.
- In Settings, open Two-factor authentication and scan the QR code with an authenticator app, or type the setup key by hand.
- Enter the six-digit code from the app to switch it on.
- Save the one-time recovery codes it shows. Each works once if you lose your authenticator, and you will not see them again.
Keep your recovery codes somewhere safe and separate from your phone. If you lose both your authenticator app and your codes, open a ticket so we can help you recover access.
Passwords
You can change your password any time from Settings while signed in, and reset it from the sign-in screen if you are locked out.
- Change it in Settings by entering your current password and a new one.
- A strong password uses at least the minimum length, with an uppercase letter, a lowercase letter and a number.
- Forgot it? Use "Forgot password" on the sign-in screen. The reset link we email expires after a short time.
Sessions and connected accounts
Atlazi keeps you signed in with tokens that live only in secure, http-only cookies. They are handled on the server and never exposed to the page, so a browser extension or script cannot read your session.
- Your session refreshes quietly in the background, so you stay signed in without re-entering your password.
- If connected sign-in is configured, you can sign in with a connected account instead of a password. Only configured providers appear, so you never see a button for one that is not available.
Frequently asked questions
Do you support two-factor authentication?
Yes. Turn on Two-factor authentication in Settings using any authenticator app, and save the one-time recovery codes it gives you.
I lost my authenticator. How do I get in?
Use one of the one-time recovery codes you saved when you set 2FA up. If you have lost those too, open a ticket so we can help you recover access.
Are my sign-in tokens stored where scripts can read them?
No. Tokens live only in secure, http-only cookies handled on the server. They are never placed in local storage or exposed to page scripts.
Which connected sign-in options can I use?
Only the providers that have been configured show up on the sign-in and Settings screens. If you do not see one, it is not currently available for your account.
