Authentication & Security

This page covers sign-in for people using the ANTS Platform console. For identity provider sign-in, see Single Sign-On (SSO). For applications and agents, see API Keys.

Sign-in methods

• Email and password, unless the deployment turns it off with AUTH_DISABLE_USERNAME_PASSWORD=true or blocks it for your email domain with AUTH_DOMAINS_WITH_SSO_ENFORCEMENT.
• SSO through the identity providers configured for the deployment. See Single Sign-On (SSO).

Every sign-in, failed sign-in, sign-in code challenge, sign-up, sign-out and password reset is recorded in Audit Logs.

Passwords

• At least 8 characters, with at least one letter, one number and one special character.
• Stored as bcrypt hashes.
• Accounts linked to a company identity provider (such as Okta, Entra ID or a custom OIDC provider) cannot have a local password. They show Managed by your identity provider.
• Accounts that sign in with Google, GitHub or GitLab can add a password in Account settings.

Sign-up. A new password account is created only after the person opens the verification link sent by email. The link is valid for 24 hours. A deployment can make sign-up invite only with AUTH_DISABLE_SIGNUP=true.

Password reset. Go to Forgot password? on the sign-in page. A 6-digit code is emailed and is valid for 3 minutes. Five wrong codes lock resets for that address for 15 minutes. Reset needs an email server on the deployment. If none is configured, the page says "Password reset is not configured on this instance."

Two-step sign-in (emailed code)

ANTS Platform can ask for a 6-digit code, sent by email, after a correct password.

• Applies to email and password sign-in only. SSO sign-ins are never challenged; enforce MFA in your identity provider.
• The code is valid for 5 minutes. Five wrong codes lock sign-in for 15 minutes. You can resend up to 3 times, 60 seconds apart.
• The only factor is an emailed code. Authenticator apps, passkeys and recovery codes are not supported.

The deployment setting AUTH_REQUIRE_MFA decides how it works:

Organization switch. Go to Organization Settings → General → Security → Two-step sign-in. It is on by default. Changing it needs tenantSecurity.features:admin (Owner and Security & Compliance among the built-in roles). Turning it off asks for step-up verification when that is enabled. A person is challenged if any organization they belong to requires it.

Two-step sign-in needs an email server on the deployment. Without one the switch shows Unavailable and no code is asked for.

Step-up verification

When the deployment sets STEP_UP_ENABLED=true, sensitive actions ask you to confirm it is you. A Confirm it's you dialog emails a 6-digit code; enter it and select Verify. It is off by default.

• The code is valid for 5 minutes. After a successful check, all protected actions are allowed for 15 minutes.
• Five wrong codes lock step-up for 15 minutes. You can resend up to 3 times, 60 seconds apart.
• It applies to SSO users too.
• If the deployment cannot send email, protected actions are refused. Budget AI actions are the exception: they show Are you sure? with Continue anyway, and the bypass is recorded in Audit Logs.

Protected actions:

• Setting a new password while signed in, and an SSO user adding a first password.
• Creating project or organization API keys.
• Adding or changing an LLM connection.
• Creating or editing a custom role.
• Changing a member's organization or project role.
• Creating a data export and changing the blob storage export destination.
• Turning off organization Two-step sign-in.
• Connecting the Copilot Studio and Microsoft 365 Copilot connectors.
• Budget AI: creating, updating, moving, rotating, rolling back and importing provider credentials; creating and rotating keys, changing a key's IP allow-list, and unblocking a key.

Deleting API keys, editing notes, and inviting or removing members do not ask for step-up.

Sessions

• Sessions last up to 30 days by default (AUTH_SESSION_MAX_AGE, in minutes) and are refreshed while you use the app.
• You are signed out after 120 minutes without activity (AUTH_SESSION_IDLE_TIMEOUT_MINUTES). Mouse, keyboard, scroll and touch activity keep the session alive. There is no warning before sign-out.
• Sign out ends the session in that browser only. There is no list of active sessions and no sign-out everywhere.
• When a person is deactivated or deleted through SCIM, every open session they have ends at once: their next request is refused and they are signed out.
• When a member is removed from every organization by Okta access reconciliation, their session ends on the next request. Removal on the Members page does not end an open session, but the person loses access to that organization.

Data processing consent

Each console user is asked once to accept data processing: "We collect and process your information to provide and improve this service. By clicking Accept, you consent to this." A notice bar with Accept appears at the bottom of the page. API and SDK traffic is not affected. The text is fixed and cannot be edited.

Withdraw consent in Account settings → Security & privacy → Privacy → Data processing consent: select Review, then Withdraw consent. You are signed out and cannot use the console until you accept again. Account deletion is scheduled for 30 days later and is carried out when the deployment has consent deletion turned on. Signing back in and accepting cancels it. Acceptances and withdrawals are recorded in Audit Logs.

Account settings

Open Account settings from your user menu in the header.

• Profile: your name, email, organization count and appearance (theme and font, saved in this browser). Name and email come from sign-up or your identity provider and cannot be edited here.
• Security & privacy: Password (Set password, Reset password, or Managed by your identity provider.), Sign out, and Data processing consent.

Device authentication for Discover AI agents

The Discover AI desktop agents and browser extension authenticate devices, not people. Choose the method per project in Project Settings → Deployment & Keys → Authentication method:

Changing the method needs Discover AI configuration write access. The deployment can require device certificates for every project, and certificates need a certificate authority configured on the deployment. Members who manage Discover AI enrollment are notified before a certificate expires. See Discover AI deployment.

Encryption

Stored credentials (LLM connections, SSO secrets, integration and connector credentials, Budget AI provider secrets) are encrypted at rest with AES-256-GCM. API key secrets are stored only as hashes. See Data Privacy.

Next steps

• Single Sign-On (SSO)
• SCIM Provisioning
• Audit Logs