Security checklist

The API key

• It is in your server’s secret settings (environment, user secrets, a vault), not in source code, not in a browser, not in a mobile app.
• Each application has its own key. You know how to create a new one and revoke the old one in the console without downtime.

Signing in

• The second step comes right after the password, on the server. The session counts as signed in only after APPROVED, TRUSTED, or your policy for NO_METHOD.
• SecondStep lives in the server-side session only.
• The IP address you send is the visitor’s, from your own trusted proxy.
• DENIED ends the sign-in and suggests changing the password.
• Remembered-device cookies are HttpOnly, Secure, SameSite=Lax.

Failing closed

• TenonAuthUnavailable refuses the sign-in, except for a short, reviewed list of emergency accounts whose every sign-in is logged and alerted.
• ApiKeyRejected never lets anyone in.

Changing methods

• Changing or removing a method needs fresh proof (a code, an approval or the password).
• Users get their recovery codes once, right after setting up a method.
• Email codes go only to addresses from your own records.

Recovery

• Your helpdesk issues access passes only after an identity check in person, on a video call or through a manager.
• There is no email link or security question that removes the second step.

When someone leaves

• deleteUser is part of closing an account.