client.auth.settings

client.auth.settings — the auth.settings operations.

On AsyncKindgi every method is the same, awaited.

client.auth.settings.get()

get(*, timeout: float | None = None) -> AuthSettings

Signature

The workspace's sign-in settings. GET /v1/auth/settings

Whether signing in takes a second factor, and how many people's keys are still on the deployment's previous sign-in secret, or on neither. Tenant admins only. Mounted when the deployment keeps second factors (from 0.1.9).

client.auth.settings.update()

update(
    body: AuthSettingsPatch | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> AuthSettings

Signature

Require a second factor at sign-in. PATCH /v1/auth/settings

Covers signing in by the deployment's own ways in (the emailed link, and providers like Google, Microsoft and GitHub). Signing in through the workspace's own identity provider is exempt: it owns MFA there. A site's people sign in through the site, which owns their second factor, so the setting doesn't apply to them. Once required, a session made without a second factor ends at its next request, and signing in to the console with an API token is refused. API keys aren't covered: keep them to service accounts, and rotate them. From a session, turning it on takes a session made with your own second factor (409 second-factor-enroll-first): it would end yours. Audited. Tenant admins only. Mounted when the deployment keeps second factors (from 0.1.9).