Two-Step Sign-In: Security Keys, Passkeys and Authenticator Apps
A stolen password should not open your armory records. Every APB360 portal user can now add a second step at sign-in, using the method that suits them: a physical security key, a passkey, a fingerprint or face on a device they already own, or an authenticator app. It is optional, included at no additional cost, and modeled on how Amazon Web Services protects its own console.
Choose Your Method. Or Several.
- Security keys. Tap a key on a phone or touch it in a USB port. Any FIDO2 key works, including YubiKey, Google Titan and FIPS-validated models.
- Passkeys and built-in biometrics. Touch ID, Face ID, Windows Hello and synced passkeys, with nothing extra to buy.
- Authenticator apps. Google Authenticator, Microsoft Authenticator or any other standard app that shows a six-digit code, plus hardware code tokens.
- Up to eight methods per person. Name each one and pick whichever is handy at sign-in. We encourage registering at least two, so one lost key never locks you out.
We deliberately left out text-message codes. Security keys and passkeys are the strongest choice here: they are tied to the real APB360 sign-in page, so a look-alike phishing site gets nothing it can use.
Stronger Than a Second Password
- Every sign-in, every time. There is no “remember this device.” No session starts until both steps pass.
- Twelve-hour sessions. Once 2-step is on, a session ends after 12 hours at most.
- No email back door. Once 2-step is on, a password cannot be reset by email. Recovery goes through APB360 support, and an administrator makes the audited reset.
- “This wasn’t me.” Each security email has a link that locks the account at once and ends every session until an administrator restores it.
- Protected changes. Adding or removing a method, or turning 2-step off, needs a method confirmed within the last ten minutes, and every change is logged.
- Codes that work once. An authenticator code cannot be replayed, and app secrets are stored encrypted.
Recommended Devices
You do not need to buy anything if your phone or computer already supports passkeys. If you would like a dedicated key, these are good places to start. Any FIDO2 key works; for most people, a key with NFC is the most flexible because it works with both a computer and a phone. Check that the connector matches your computer.
- YubiKey 5C NFC (USB-C and NFC). Yubico · Amazon
- YubiKey 5 NFC (USB-A and NFC). Yubico
- Yubico Security Key C NFC (USB-C and NFC, lower cost). Yubico store · Amazon
- Yubico Security Key NFC (USB-A and NFC, lower cost). Yubico store · Amazon
- YubiKey 5 FIPS, for agencies that require FIPS 140-3 validated hardware. USB-C · USB-A
- Google Titan Security Key (USB-A or USB-C, with NFC). Google Store
- Google Authenticator (free). App Store · Google Play
- Microsoft Authenticator (free). App Store · Google Play
APB360 does not sell these products. Availability and pricing are set by each seller.
How to Turn It On
Sign in to the APB360 portal and open Sign-in security under My Account. Add two methods, then turn on Require 2-step sign-in. Nothing changes for anyone until they turn it on.
Questions? Email help@apb360.com or call 251-677-7978.