Your sign-ins and two-factor

Your account's password, two-factor and signed-in devices are kept by WorkOS, the sign-in service Alchex uses. Settings → Security shows WorkOS's own screens for them, inside Alchex. These screens are in English whatever language you use Alchex in.

Signed-in devices

Every time you sign in, your account opens a session — a signed-in place that stays open until it is signed out. Sessions are per browser and per device, not per tab. The sessions list names each one by its browser and operating system, with where and when it was last used. The one you are reading this on is marked This device.

Sign out on any row closes that one session. Whoever was using it is signed out and has to sign in again; nothing else about the account changes.

Sign out of all other devices closes every session except the one you are using. This is the right move if you have lost a laptop or phone, if you signed in on a shared computer, or if you see a sign-in you do not recognise.

It takes effect at once. The next thing that device asks Alchex for is refused. A page already open there may keep showing what it had loaded, because a rendered page makes no request until you click something; the moment it does, that person is at the login screen.

Closing a browser leaves its session open, so a list of ten sign-ins usually means ten times you have signed in, not ten devices logged in right now.

Password

Password lets you change it, or set one if you have only ever signed in with Google or Microsoft or an emailed code.

Two-factor authentication

Two-factor means a stolen password is not enough on its own: signing in also needs a six-digit code from an app on your phone.

To turn it on, choose Set up authenticator app. Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy, or any other), then type the six-digit code the app shows to confirm. Setup is not finished until the code matches. From then on, every sign-in asks for the code after your password.

You can remove your authenticator from the same screen, and sign-in goes back to the password alone. If a workspace you belong to requires two-factor, removing it means that workspace asks you to set one up again the next time you open it. If you lose the device your authenticator lives on, ask your workspace owner: recovery is a deliberate, person-checked step rather than a self-service switch.

Requiring two-factor for a workspace

Whether two-factor is required is each workspace's choice. A workspace admin turns it on under Settings → General with Require every member to set up two-factor. It is off until someone turns it on.

The switch decides who must have an authenticator app, not who is asked for a code. Anyone who has set one up on their own account is asked for its code at every sign-in, in every workspace, whether this switch is on or off. To stop being asked, remove the app under Settings → Security.

While it is on:

• A member without an authenticator is asked to set one up before they can open the workspace. The page names the workspace and shows the same setup screen as above; once the code matches, I've set it up, continue lets them in. Nothing of theirs is removed while they are kept out.
• It applies everywhere the workspace is reached, including AI assistants connected through the workspace's MCP server.

It takes effect on the very next thing each member does, including the admin who turned it on — if you have no authenticator yet, you are asked to set one up straight away. Turning it off again lets everyone straight back in; members who already set up an authenticator keep it.