Passkeys first
Passwordless sign-in with passkeys (WebAuthn/FIDO2): phishing-resistant, with platform and roaming authenticators.
- Passkeys as first or second factor
- Recovery codes
- Optional magic-link sign-in by e-mail
Authentication & MFA
Strong sign-in, on by default.
Passwordless sign-in with passkeys, multi-factor authentication on by default, and step-up when the risk calls for it.
What you get
MFA on by default
Multi-factor authentication with authenticator apps, required per realm.
- Authenticator apps (TOTP)
- Adaptive step-up authentication
- Push approval with number matching via the HelixIAM Authenticator app Early access
Password hygiene
When passwords are used, they are handled carefully.
- Argon2id password hashing
- Brute-force lockout and password policy
- Breached-password checks
Sign-in journeys
Design sign-in journeys in the admin console, with a simple step view and an advanced flow canvas.
- Per-realm settings
- Per-realm branding of sign-in pages
- English and Dutch sign-in pages
See sign-in on a running system.
Passkeys, MFA and step-up, configured for your realms.