SEK SystemsDocs Open console

Getting started

Sign-in and security keys

The console is at https://console.sek.systems. Signing in has two parts: who you are (a password, your organisation's single sign-on, or a linked Microsoft, Google or Apple account), and proof that you hold a registered security key or passkey.

Your account

  • SEK Systems creates the first account of a new environment, with the owner role. You receive the sign-in name and a one-time password through a separate channel.
  • Everyone else is invited by an owner or admin (Settings → Access & SSO → Invitations). See Invitations.
  • One account can be a member of several environments, with a different role in each. Use the environment switcher at the top of the console.

Sign in

  1. Open https://console.sek.systems. The page is titled Sign in to SEK Systems.
  2. Choose one way to identify yourself:
    • User name or e-mail and Password, then Sign in;
    • one of the buttons under Or sign in with a linked account (Microsoft, Google, Apple), if your account is linked;
    • your work e-mail under Your organisation uses single sign-on? and Continue with SSO. The domain of the e-mail address selects your organisation's identity provider.
  3. If your account needs a key, the next page is Confirm with your security key. Click Continue with security key and use the key: touch it, or use the fingerprint, face or PIN prompt of your device.

A security key is required at sign-in for:

  • everyone who has registered a key;
  • owners and admins (the setting Security key at sign-in: owners and admins is on by default);
  • all members, if an owner turned on Passkey required in the sign-in policy.

Note

There is no sign-in with a passkey alone: the key always comes after the password or the linked account.

Register your first key

If your account needs a key and has none yet, the key page becomes Register a security key:

  1. Enter a name for the key (for example "YubiKey blue" or "Work laptop").
  2. Confirm once with the key or with your device.

Afterwards, manage your keys under Settings → Access & SSO → Your security keys.

Which keys work

Any FIDO2/WebAuthn authenticator works:

Kind Examples Shown as
Hardware key YubiKey, SoloKey, Nitrokey, Feitian Device-bound / hardware key
Built-in authenticator Windows Hello, Touch ID, Android screen lock Device-bound, or Synced passkey when the platform syncs it
Passkey in a password manager or cloud account iCloud Keychain, Google Password Manager, 1Password Synced passkey
Your phone, from another computer the browser's "phone or tablet" option phone (QR/Bluetooth)

An owner or admin can require device-bound keys for approvals (Settings → Access & SSO → Approvals require a hardware (device-bound) key). Synced passkeys still work for signing in.

Use your phone as the key

You can sign in on a computer and confirm with a passkey on your phone. This uses the browser's own dialog; the console adds no app.

  1. On the key page, click Continue with security key.
  2. In the browser dialog, choose Use a phone or tablet (the wording depends on the browser).
  3. Scan the QR code with the phone's camera. The phone and the computer connect over Bluetooth (both need it on), so the phone must be near the computer.
  4. Confirm on the phone with your fingerprint, face or screen lock.

Add a second key, test a key, remove a key

Under Settings → Access & SSO → Your security keys:

  • Add security key registers another key. This asks for confirmation with a key you already have (a step-up).
  • Test key lets you try a registered key. A test grants nothing: no sign-in, no step-up and no approval. Use it to check that a spare key still works before you need it.
  • Remove deletes a key, also after a step-up.

Step-up: the key for important actions

Some actions ask for your key again, even when you are signed in: approving plans, confirming the agent count, revoking an agent, changing roles, removing members, inviting people, managing identity providers, and adding or removing keys. The console asks once; a confirmation stays valid for 5 minutes.

Sessions

  • A session ends after 30 minutes without activity and after 12 hours at most.
  • The account menu (top right) → Your sessions… shows your sessions, with Sign out and Sign out everywhere. There you can also link a Microsoft, Google or Apple account under Sign-in methods.

Invitations

  1. An owner or admin opens Settings → Access & SSO → Invitations, enters the e-mail address and the role, and clicks Invite. Only an owner can invite another owner.
  2. The console shows the invitation link once. Send it to the person yourself. It is valid for 7 days.
  3. The invitee opens the link and accepts with your organisation's single sign-on, or with a linked Microsoft, Google or Apple account. The e-mail address must be verified by that provider and match the invitation.

Note

SEK Systems never creates accounts by itself from a sign-in. A sign-in without an account or invitation shows: "Your account has no access to SEK Systems yet. Ask an administrator for an invitation."

Lost or broken key

There is no e-mail reset and there are no recovery codes. This is deliberate: an attacker who controls your mailbox must not be able to take over an account that can approve changes on your servers.

  1. Use another registered key. This is why you should register two.
  2. Ask SEK Systems support. Support first verifies your identity through a separate channel. You then get a new password and a one-time setup code (valid 24 hours). Open the link you receive, enter your e-mail, the password and the setup code, and register a new key with Continue with security key.
  3. Afterwards, remove the lost key under Your security keys, so it can no longer be used.

See also Troubleshooting: sign-in.