> ## Documentation Index
> Fetch the complete documentation index at: https://help.casaconect.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How people sign in to Casa Conect: passwordless email codes, authenticator-app MFA, session management and re-authentication for sensitive changes.

Casa Conect uses **WorkOS AuthKit** as its identity provider. Sign-in, multi-factor authentication and session handling are delegated to a specialist service instead of being built in-house, and Casa Conect never holds a password database.

## Passwordless sign-in

You sign in by entering your email address and then the one-time code sent to it. There are no passwords to choose, reuse, phish or leak.

<Note>
  The security of your Casa Conect account therefore rests on the security of your **mailbox**. Protect your email account with a strong password and multi-factor authentication, and add an authenticator app to Casa Conect as a second step.
</Note>

## Two-factor authentication

Any user can add an authenticator app (TOTP) under **Settings → Security → Two-factor authentication**. Once it is on, *a code from your authenticator app is required when you sign in*, in addition to the emailed code.

<Steps>
  <Step title="Choose Authenticator app">
    You may be asked to **sign in again** first. See [Re-authentication](#re-authentication-for-sensitive-changes).
  </Step>

  <Step title="Scan the QR code">
    Scan it with an authenticator app such as Microsoft Authenticator, Google Authenticator or 1Password. The entry appears as *Casa Conect*.
  </Step>

  <Step title="Enter the 6-digit code">
    This confirms the enrolment.
  </Step>
</Steps>

If you remove the authenticator, *signing in will only ask for the code we email you*.

## Sessions

**Settings → Security → Sessions** lists the *devices currently signed in to your account*, with each session's location, browser, sign-in method and dates. The session you are using is marked **This device**.

Choose **Sign out** next to any other session to end it immediately. To end the session you are using, sign out normally.

## Re-authentication for sensitive changes

Some changes need proof that it is really you, now, and not someone at an unlocked laptop. Before you can **change your email address**, **add an authenticator app** or **remove one**, you must have signed in recently. If you have not, you see:

> **Confirm it's you**: For security, sign in again before changing this. You'll come straight back here.

This check uses the time of your last *actual* sign-in. Silently refreshing a session does not count.

Changing your email address also requires a code sent to the **new** address. The change is applied only once that code has been confirmed.

## How sign-in is verified

Every request to Casa Conect carries a short-lived, signed token issued by the identity provider. The API verifies the signature and the token's claims on every request, and takes the user's organization and role from the token rather than from anything the browser sends separately. Authentication failures are logged without any token material. If the identity provider is unavailable, the API reports a temporary outage rather than signing everyone out.

## Single sign-on

<Note>
  SAML or OIDC single sign-on and directory provisioning (SCIM) are **not currently available**. If your organization requires SSO, [tell us](mailto:support@casaconect.ai). It helps us prioritize.
</Note>

## Microsoft Word

The [Word add-in](/word-add-in/overview) signs you in through the same identity provider, in a secure dialog. It never sees your email code, and its access can be ended like any other session.