Trusted Devices
Trusted devices let the gateway remember a browser after a successful MFA verification.
How It Works
Section titled “How It Works”- A trusted-device cookie is set after verification
- Future web logins skip the MFA prompt until the TTL expires (default 30 days)
- Trust is browser-specific, and only applies to web logins: a CLI login asks for MFA whenever it applies to you
- A trusted device is not a factor: sensitive actions that need step-up still ask you to verify one
- Trusting a device needs a step-up
Trusting a Device
Section titled “Trusting a Device”You can trust a device in two ways:
During MFA Verification
Section titled “During MFA Verification”- Complete MFA verification
- Check Trust this device for N days (the configured TTL, 30 by default)
- Finish sign-in
From Account Security
Section titled “From Account Security”- Go to Account Security
- In Trusted Devices, click Trust This Device
Managing Trusted Devices
Section titled “Managing Trusted Devices”The Trusted Devices table shows:
- Device
- Last used
- IP
- Expires
To revoke a device, click Revoke next to the entry (this needs a step-up).
Configuration
Section titled “Configuration”Admins can set the trusted-device TTL in Settings → MFA Requirements (mfa_trusted_device_ttl_days).