Security policy
Three org-wide switches, saved together with Save Policy:- Require SSO for sign-in — members must authenticate through your identity provider.
- Allow break-glass password sign-in for admins — an emergency password path for admins while SSO is enforced (only configurable when enforcement is on).
- Require passkeys for organization access — every member must register a passkey and pass a post-login passkey check. Members without one get a 3-day grace period to set it up; the policy panel shows how many members still need one.
Org API keys are exempt from this requirement.
Passkeys are a human 2FA check tied to a login session; server API
keys (
sk_live_...) are machine credentials with no session to attach
a passkey check to, so they keep authenticating even when this policy
is on — by design, not by omission. When the requirement is enabled
and your organization has active API keys, the policy panel shows how
many are exempt, with a link to Organization → Keys so admins can
audit or revoke any that shouldn’t still be active.SSO connections
ThunderPhone’s SSO is backed by Stytch. Add connection creates one with:
Deleting a connection removes it permanently — users who signed in
through it can no longer use it.
Setting up the identity-provider side requires a Stytch organization;
if you don’t have those identifiers, contact
support to get your organization
provisioned.
Next steps
Invite your team
Roles and invitations for members joining outside SSO.
Account & security
What the passkey requirement looks like for each member.