Security and sign-in
This page covers how people sign in to your workspace, and the controls that protect their accounts: two-factor authentication, session timeouts and single sign-on (SSO).
How people sign in
| Method | Notes |
|---|---|
| Email and password | The default. |
| Google, GitHub or Slack | Shown as Continue with … buttons on the sign-in page. Invited people can also use these to accept their invitation. |
| SSO (SAML 2.0) | For organizations that sign in through their identity provider. See Single sign-on. |
When someone's email domain is set up for SSO, they must sign in through your identity provider. Trying another method shows "Your organization signs in with SSO."
Connecting SSO turns off Google and GitHub sign-in for the workspace, so your identity provider is the only way in. You can turn them back on (see below), but then people can sign in with Google or GitHub and bypass your identity provider, including its offboarding.
Two-factor authentication
Two-factor authentication (2FA) asks for a code from an authenticator app in addition to the password.
Turn it on for yourself
- Open your profile from the left-hand menu.
- Next to Two-factor authentication, choose Enable.
- Scan the QR code with an authenticator app, then enter the 6-digit code it shows.
- Save your recovery codes. Each can be used once if you lose your device. Copy them somewhere safe before closing the window.
To turn it off, choose Disable and confirm with your password. If your workspace requires 2FA, this is not possible.
Require it for everyone
A workspace admin can make 2FA mandatory under System → Session timeouts, with Require two-factor authentication for all users.
- It applies immediately, including to people who are already signed in.
- Anyone without 2FA set up is asked to enrol before they can do anything else.
- Nobody can turn their own 2FA off while the requirement is on.
Extra checks for sensitive actions
People who have 2FA on are asked for a fresh code when they create or revoke an API key.
Session timeouts
Under System → Session timeouts, admins control how long people stay signed in. The settings apply to everyone in the workspace.
| Setting | Range | If left empty |
|---|---|---|
| Idle timeout (minutes) | 5 to 43,200 | No idle timeout. |
| Absolute timeout (days) | 1 to 365 | 7 days. |
- The idle timeout signs people out after a period of inactivity. It applies immediately to sessions that are already open.
- The absolute timeout is the longest a session can last, however active the person is. It applies to sessions created after you save.
To end a person's sessions straight away, use Sign out everywhere on the Users page. Their account stays active.
Single sign-on (SAML)
Regen works with SAML 2.0 identity providers such as Okta, Microsoft Entra ID, Google Workspace and OneLogin.
Only the workspace owner can connect SSO, because a connected identity provider can sign in as any user in the workspace.
- Open Integrations and choose to configure SAML SSO.
- Paste your identity provider's metadata URL. Regen creates its own signing certificate the first time you save, so you do not supply one.
- Copy the SP metadata URL and ACS URL that Regen shows, and enter them in your identity provider.
- Optionally allow IdP-initiated login, which lets people start from their identity provider's app list.
After SSO is connected, the same dialog has an Allow Google and GitHub sign-in option. It is off by default. Leave it off if your identity provider handles joiners and leavers.
Email domains
Add the email domains your people use, such as acme.com. Regen shows a TXT record to add at your DNS provider to prove you own each domain. Changes can take a few minutes; then choose Verify. People with a verified domain are sent to your identity provider when they sign in.
For the identity-provider side of SAML, such as attribute mapping, the SAML guide for self-hosting explains the concepts. Its environment-variable setup applies to self-hosted installs only.
Good practice
- Turn on Require two-factor authentication if you do not use SSO.
- Set an idle timeout that suits your team. On-call people are often signed in all day, so pick a value that does not interrupt them.
- Give only a few people the Admin and Owner roles. See Users, roles and teams.
- Remove people who leave: Deactivate them on the Users page.