Docs/ Security/ Authentication & 2FA

Authentication & 2FA

Secure your sh0 instance with password or Google OAuth login, and add an extra layer of protection with two-factor authentication.

sh0 supports two sign-in methods for people. Both open the same dashboard session; programs use API keys instead.

Password Authentication

The default method. There are no default credentials: the first account is created on the setup screen of a fresh installation, and every other account is invited by an administrator.

The sign-in exchange, the session cookies and the two-factor step are described for developers in API Authentication.

sh0 login page with email and password fields

Google OAuth

For sh0 Cloud users, Google Sign-In is available as a login method. This uses Google's OAuth 2.0 flow with ID token verification via JWKS.

Click Sign in with Google on the login page.
Authenticate with your Google account.
sh0 verifies the ID token and creates or links your account.

Note

For self-hosted instances, Google OAuth requires configuring a Google Cloud project with OAuth credentials. See Settings → Authentication to enter your Client ID and Client Secret.

Enabling Two-Factor Authentication

Two-factor authentication (2FA) adds an extra layer of security by requiring a time-based one-time password (TOTP) in addition to your regular credentials.

Open your Profile page in the dashboard.
Click Enable 2FA.
Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.).
Enter the 6-digit code from your authenticator app to verify setup.
Save your backup codes in a secure location.

2FA setup screen showing QR code and verification field

Once enabled, every login will require the 6-digit TOTP code after entering your email and password.

Warning

If you lose both your authenticator and your backup codes, recover the account from the server itself, without signing in. The command resets the password, disables two-factor authentication and revokes every open session:

Terminal (on the server)

sudo sh0 users reset-password [email protected] --disable-2fa

Output

Password reset for [email protected] (318a52d95557639444c765ea8de8b0f5)

Revoked 14 refresh token(s). Sessions already open are rejected on their next request -- they are not left alive until their access token expires.

Without --password, a random temporary password is generated and printed. Sign in with it, then choose a new password and enable two-factor authentication again.

Backup Codes

When you enable 2FA, sh0 generates 20 single-use backup codes and stores only their hashes. Each code can be used once in place of a 6-digit code if you lose access to your authenticator app.

Danger

Store your backup codes in a secure, offline location (password manager, printed paper in a safe). These codes are your only recovery method if you lose your authenticator device. They are shown only once during 2FA setup.

You can regenerate backup codes from your Profile page with Regenerate backup codes. You confirm with a current 6-digit code, and all previous backup codes stop working.

Changing Your Password

To change your password:

Open your Profile page.
Go to the Password section.
Enter your current password and new password.
Confirm the new password and save.

Change password form in profile settings

Passwords are hashed with Argon2id before storage. sh0 enforces a minimum password length of 8 characters.

Tip

Changing your password signs out every other session at once: anyone who had your old password loses access immediately.

Session Management

A dashboard session lasts 24 hours and renews itself while you keep using the dashboard; a session left unused for 30 days ends. There is no session list to manage: to end every session of an account, change its password, or run the recovery command above on the server.

Multi-Server

Teams & RBAC