Skip to main content
Casa Conect uses WorkOS AuthKit as its identity provider. Sign-in, multi-factor authentication and session handling are delegated to a specialist service instead of being built in-house, and Casa Conect never holds a password database.

​
Passwordless sign-in

You sign in by entering your email address and then the one-time code sent to it. There are no passwords to choose, reuse, phish or leak.
The security of your Casa Conect account therefore rests on the security of your mailbox. Protect your email account with a strong password and multi-factor authentication, and add an authenticator app to Casa Conect as a second step.

​
Two-factor authentication

Any user can add an authenticator app (TOTP) under Settings → Security → Two-factor authentication. Once it is on, a code from your authenticator app is required when you sign in, in addition to the emailed code.
1

Choose Authenticator app

You may be asked to sign in again first. See Re-authentication.
2

Scan the QR code

Scan it with an authenticator app such as Microsoft Authenticator, Google Authenticator or 1Password. The entry appears as Casa Conect.
3

Enter the 6-digit code

This confirms the enrolment.
If you remove the authenticator, signing in will only ask for the code we email you.

​
Sessions

Settings → Security → Sessions lists the devices currently signed in to your account, with each session’s location, browser, sign-in method and dates. The session you are using is marked This device. Choose Sign out next to any other session to end it immediately. To end the session you are using, sign out normally.

​
Re-authentication for sensitive changes

Some changes need proof that it is really you, now, and not someone at an unlocked laptop. Before you can change your email address, add an authenticator app or remove one, you must have signed in recently. If you have not, you see:
Confirm it’s you: For security, sign in again before changing this. You’ll come straight back here.
This check uses the time of your last actual sign-in. Silently refreshing a session does not count. Changing your email address also requires a code sent to the new address. The change is applied only once that code has been confirmed.

​
How sign-in is verified

Every request to Casa Conect carries a short-lived, signed token issued by the identity provider. The API verifies the signature and the token’s claims on every request, and takes the user’s organization and role from the token rather than from anything the browser sends separately. Authentication failures are logged without any token material. If the identity provider is unavailable, the API reports a temporary outage rather than signing everyone out.

​
Single sign-on

SAML or OIDC single sign-on and directory provisioning (SCIM) are not currently available. If your organization requires SSO, tell us. It helps us prioritize.

​
Microsoft Word

The Word add-in signs you in through the same identity provider, in a secure dialog. It never sees your email code, and its access can be ended like any other session.