🔐 Security (2FA, SSO)

Two-factor authentication, API keys, sessions, audit log and SAML SSO — managed from Workspace → Security.

Two-factor authentication (TOTP)

2FA adds a 6-digit time-based code (TOTP) on top of your password at login. It works with any authenticator app (Google Authenticator, Authy, 1Password…).

Plan requirement: 2FA is included in the Business plan (and Enterprise). On lower plans the Enable button returns an upgrade prompt — see pricing and Billing to upgrade.

To enable it:

• Security → Two-factor authentication → Enable 2FA: a secret and QR code are generated. Scan the QR (or paste the secret manually) in your authenticator app.
• Enter the 6-digit code shown by the app to confirm. 2FA is now active for your account.
• Recovery codes are displayed once at activation — store them safely. Each recovery code can be used a single time in place of a TOTP code if you lose your device; a used code is invalidated immediately.

At login, the TOTP code (or a recovery code) is required after your password. Disabling 2FA requires re-entering your password.

API keys and credentials

Your account has three kinds of credentials. Never confuse the public one with the secret ones:

Credential	Prefix	Nature
Embed key	fk_…	Public. Identifies your configurator in embed URLs (/e/fk_…) and the widget. Safe to expose in frontend code.
API secret	sk_…	Secret. Server-side only — never put it in frontend code or a repository. It is hidden from users with the Member role.
Scoped API keys	pk_…	Secret. Named keys with granular permissions, created from the Security page for API integrations.

Scoped API keys (Security → API Keys, Owner/Admin only):

• Each key has a name, a set of scopes — read, write, billing, admin (admin implies all others) — and an optional expiration (30 days, 90 days, 1 year, or never).
• The full key is shown once at creation; only a SHA-256 hash is stored, so it can never be displayed again. The list shows the key prefix, scopes, creation date and last-used date.
• Revoke a key at any time — requests using it fail immediately. Expired keys are rejected automatically.

Rotation: the embed key and the API secret can each be regenerated from Settings (Rotate embed key / Rotate API secret). Rotation invalidates the previous value immediately — update your integrations right after. For scoped keys, rotate by creating a new key, deploying it, then revoking the old one.

Sessions

Signing in creates a server-side session with a random token, delivered in an HttpOnly, Secure (over HTTPS), SameSite=Lax cookie, valid for 14 days. Each session records the IP address and user agent it was created from. If 2FA is enabled, the session is only created after the TOTP step. Accepting a team invitation or signing in via SSO also creates a standard session.

Audit log

Security → Audit log (Owner/Admin only) shows the last 100 actions on your account, filterable by action, user and date. Each entry records the timestamp, action name, affected entity, actor email and IP address. Logged events include, among others: 2fa.enabled, 2fa.disabled, 2fa.recovery_used, apikey.created, apikey.revoked, team.invited, saml.login, plus billing events (plan changes, cancellations).

SAML SSO

Authenticate your team through your identity provider (Okta, Azure AD, Google Workspace, OneLogin…) via SAML 2.0. In Security → SSO SAML, enter your IdP's Entity ID, SSO URL and X.509 certificate; PrintWearAI then gives you the SP metadata URL to register on the IdP side. Users signing in via SSO for the first time are created automatically in your workspace with the Member role (see Team management to promote them).

Platform hardening

The platform enforces a Content-Security-Policy in the browser and collects CSP violation reports (rate-limited, cookie-less) to keep tightening the policy over time. Stripe handles all card data — PrintWearAI never stores card numbers (see Billing). Passwords are stored as bcrypt hashes; API keys as SHA-256 hashes; webhook deliveries are HMAC-signed (see Webhooks).

Best practices

• Enable 2FA for the Owner and every Admin account.
• Keep sk_… and pk_… keys out of frontend code, logs and version control; only the fk_… embed key is public.
• Create one scoped key per integration, with the minimum scopes needed and an expiration date; revoke unused keys.
• Rotate the API secret immediately if you suspect a leak.
• Give collaborators the Member role by default; reserve Admin for people who manage billing and security (roles).
• Review the audit log regularly for unexpected logins or key creations.