Passkeys, TOTP, and the rest of the sign-in path
The goal is not one perfect factor. It is that no single stolen thing is enough.
Worksynk supports WebAuthn passkeys — fingerprint, Face ID, or a hardware key. A passkey is not phishable in the way a password is, because there is nothing to type into the wrong site.
Passwords and TOTP are still there, with recovery codes. Both the secret and the codes are encrypted at rest and never returned by the API.
Layers past the login screen
Sign-ins are recorded, so an unfamiliar session is something you can find rather than something you suspect. Workspaces on the right plan can restrict access to known addresses entirely, which turns a leaked credential from an incident into a failed attempt.
The part people forget
Authentication is only half of it. What someone reaches after signing in is decided by a workspace role and a project role together, and by which modules are switched on — a disabled module blocks its endpoints, not just its menu item.
Reading a credential from the vault can require a one-time code on top of all of that, so a borrowed session is not enough to walk away with secrets.