diff --git a/docs/app/overview.mdx b/docs/app/overview.mdx index 408a346..d487ae7 100644 --- a/docs/app/overview.mdx +++ b/docs/app/overview.mdx @@ -9,6 +9,8 @@ The Fil One dashboard at [app.fil.one](https://app.fil.one) is the primary inter Go to [app.fil.one](https://app.fil.one) and sign in. Fil One supports **passkeys** (positioned as the primary method), **Google**, **GitHub**, and **email + password**. If you don't have an account yet, click **Sign up** — no credit card is required to start your 30-day free trial. +To add two-factor authentication, passkeys, or a recovery code, see [Account Security](/security/account-security). + **Verify your email first.** A new account must confirm its email address before the dashboard opens — until you do, every page redirects to a verification screen. Check your inbox for the verification email after signing up. ## Creating a bucket diff --git a/docs/security/account-security.mdx b/docs/security/account-security.mdx new file mode 100644 index 0000000..c159ed4 --- /dev/null +++ b/docs/security/account-security.mdx @@ -0,0 +1,63 @@ +--- +title: Account Security +description: Sign-in methods, two-factor authentication, passkeys, and recovery codes for your Fil One account. +--- + +This page covers securing the account you sign in with. For authenticating **API requests**, which is a separate mechanism, see [Authentication](/security/authentication) and [API Keys](/security/api-keys). + +## Signing in + +Fil One supports four sign-in methods: + +- **Passkeys**, the primary method +- **Google** +- **GitHub** +- **Email with password** + +A new account must verify its email address before the dashboard opens. Until you do, every page redirects to a verification screen. + +## Two-factor authentication + +Two-factor authentication is opt-in per user and managed from **Settings**, under **Security**. Three factor types are supported: + +| Factor | Shown in the dashboard as | What it is | +|--------|---------------------------|------------| +| Authenticator app | **Authenticator app (OTP)** | A time-based one-time code from an app such as 1Password, Authy, or Google Authenticator | +| Security key | **Security key** | A roaming WebAuthn authenticator, for example a YubiKey | +| Device biometrics | **Device biometrics** | A platform WebAuthn authenticator: Face ID, Touch ID, or Windows Hello | + +**SMS and email codes are deliberately not offered.** Both are vulnerable to SIM-swap and mailbox-compromise attacks, so Fil One only supports factors bound to a device or an app. + +You can enrol more than one factor and remove individual ones from Settings. + +## Passkeys + +Passkeys are listed separately from two-factor methods in Settings, under **Passkeys**. If you have none enrolled, the dashboard prompts you to add one on your next sign-in. + +You can hold up to **20 passkeys** on one account, which is enough to cover several devices without having to retire an old one to add a new one. + +## Recovery codes + +A recovery code is a single-use code for signing in if you lose access to your authenticator. Generate or replace one from **Settings** → **Security** → **Recovery code** → **Regenerate**. + +Generating a new code invalidates the previous one, so store the new value somewhere durable before you close the dialog. + +## Changes to security settings require re-authentication + +Four actions are gated behind a fresh two-factor check, even inside an already signed-in session: + +- Removing a two-factor method +- Removing all two-factor methods +- Removing a passkey +- Regenerating a recovery code + +If your current session was not established with a strong factor, the dashboard sends you back through sign-in to step up before the action proceeds. This means someone who gains access to an open session still cannot quietly strip the account's protections. + +## Changing your password + +Change your account password from **Settings** → **Security** → **Password** → **Change**. This sends a password-reset email to your registered address. + +## Related + +- [Authentication](/security/authentication): signing API requests with SigV4 +- [API Keys](/security/api-keys): creating and scoping keys for programmatic access diff --git a/docs/security/authentication.mdx b/docs/security/authentication.mdx index 24a444d..9199ace 100644 --- a/docs/security/authentication.mdx +++ b/docs/security/authentication.mdx @@ -9,6 +9,10 @@ import TabItem from '@theme/TabItem'; All API requests to Fil One must be authenticated using AWS Signature Version 4 (SigV4). This is the same authentication method used by AWS S3, so any S3-compatible SDK or tool handles it automatically. +:::note Looking for account sign-in? +This page is about signing **API requests**. For the account you log into the dashboard with, including two-factor authentication, passkeys, and recovery codes, see [Account Security](/security/account-security). +::: + :::note Keys and endpoints are region-specific Every access key belongs to a **single region**, chosen when you create it, and it only authenticates requests to that region's endpoint. Examples below use `eu-west-1`, the default region — for `us-east-1`, use `https://us-east-1.s3.fil.one` and region `us-east-1`. If you store data in both regions you need a key for each. ::: diff --git a/sidebars.js b/sidebars.js index e47cf3b..0614c62 100644 --- a/sidebars.js +++ b/sidebars.js @@ -28,6 +28,7 @@ const sidebars = { type: "category", label: "Security", items: [ + "security/account-security", "security/authentication", "security/api-keys", "security/encryption", diff --git a/static/llms-full.txt b/static/llms-full.txt index db86a1b..ece4fac 100644 --- a/static/llms-full.txt +++ b/static/llms-full.txt @@ -1045,6 +1045,61 @@ whether Object Lock meets a specific obligation as part of your own compliance process. +--- + +# Account Security + +Source: https://docs.fil.one/security/account-security + +Covers securing the account you sign in with. API request authentication is a +separate mechanism (see Authentication / API Keys). + +## Signing in + +Four methods: passkeys (the primary method), Google, GitHub, and email with +password. A new account must verify its email address before the dashboard +opens; until then every page redirects to a verification screen. + +## Two-factor authentication + +Opt-in per user, managed from Settings > Security. Three factor types: + +| Factor | Dashboard label | What it is | +|--------|-----------------|------------| +| Authenticator app | Authenticator app (OTP) | Time-based one-time code from an app (1Password, Authy, Google Authenticator) | +| Security key | Security key | Roaming WebAuthn authenticator, e.g. a YubiKey | +| Device biometrics | Device biometrics | Platform WebAuthn authenticator: Face ID, Touch ID, Windows Hello | + +SMS and email codes are DELIBERATELY NOT OFFERED (SIM-swap and +mailbox-compromise risk). Only device- or app-bound factors are supported. More +than one factor can be enrolled, and individual ones removed. + +## Passkeys + +Listed separately from two-factor methods, under Settings > Passkeys. With none +enrolled, the dashboard prompts to add one on next sign-in. Limit is 20 passkeys +per account. + +## Recovery codes + +A single-use code for signing in after losing access to an authenticator. +Generate or replace from Settings > Security > Recovery code > Regenerate. +Generating a new code invalidates the previous one. + +## Step-up re-authentication + +Four actions require a fresh two-factor check even within a signed-in session: +removing a two-factor method, removing all two-factor methods, removing a +passkey, and regenerating a recovery code. A session not established with a +strong factor is sent back through sign-in first, so someone with access to an +open session cannot quietly strip the account's protections. + +## Changing your password + +Settings > Security > Password > Change sends a password-reset email to the +registered address. + + --- # Authentication diff --git a/static/llms.txt b/static/llms.txt index 0f9b837..773f6eb 100644 --- a/static/llms.txt +++ b/static/llms.txt @@ -91,6 +91,15 @@ Critical integration notes for developers: ## Security +- [Account Security](https://docs.fil.one/security/account-security): securing + the account you sign in with (distinct from API request auth). Sign-in via + passkeys (primary), Google, GitHub, or email with password; email + verification is mandatory before the dashboard opens. Opt-in two-factor with + three factor types: authenticator app (OTP), security key (WebAuthn roaming), + device biometrics (WebAuthn platform). SMS and email codes are deliberately + NOT offered. Up to 20 passkeys per account. Single-use recovery codes. + Removing a factor or passkey, removing all factors, and regenerating a + recovery code all require a fresh two-factor check (step-up) - [Authentication](https://docs.fil.one/security/authentication): SigV4 auth setup for AWS CLI, Python (boto3), JavaScript (AWS SDK v3), and Go; credential best practices including environment variable usage