Protect Studio accounts

Tilecast Studio supports an authenticator app, passkeys, and single-use recovery codes. Each person manages their factors under My Account > Sign-in security. An Owner or Administrator can require multi-factor authentication for the installation under Settings > Sign-in security.

Enroll a factor

Use an authenticator app

1. Open My Account > Sign-in security.
2. Under Authenticator app, select Set up.
3. Scan the QR code with an authenticator app, or enter the displayed key by hand.
4. Enter the app’s six-digit code to confirm enrollment.

Add a passkey

Under Passkeys, select Add a passkey and follow the browser prompt. The passkey uses a fingerprint, face, screen lock, or security key, depending on the device.

Passkeys need a secure browser context. Use Studio over HTTPS with a hostname. The local development address http://localhost is also supported, but passkeys are unavailable over plain HTTP from another host or on a non-local IP address. Tilecast explains when the installation URL cannot support passkeys. Authenticator apps and recovery codes remain available.

Save recovery codes

Under Recovery codes, select Generate or Regenerate, then confirm your account password. Save the codes before closing the dialog; Tilecast shows them once and cannot display them again. Each code works once. Regenerating codes invalidates the previous set.

Require multi-factor authentication

1. Open Settings > Sign-in security.
2. Set Require multi-factor authentication to Off, Administrators, or All.

Administrators includes Owners and Administrators. All includes every account. A person in scope must enroll an authenticator app or a passkey before using the rest of Studio.

Changing the policy doesn’t sign anyone out. An account in scope that hasn’t enrolled is prompted to set up a factor at its next sign-in, then can continue into Studio after enrollment. If someone loses every factor, an Owner or Administrator can reset an account they can manage from Manage users and roles. Only an Owner can reset an Owner or Administrator account. The reset signs the person out everywhere and they must enroll again.

Remove a factor

Removing an authenticator or passkey, or generating new recovery codes, requires the account password. If the organization requires multi-factor authentication for your role, Tilecast prevents you from removing your last authenticator or passkey; add another before removing one.

For account roles and recovery by an administrator, see Manage users and roles.