Authentication

Authentication establishes who you are before the platform decides what you can do. You prove it with your password, with a second factor if your account has one, and with the sign-in that follows. A sign-in does not last forever: when its time is up, you sign in again. This page explains how that works and what you see.

How You Sign In

You sign in with your username or email plus your password. If your account has two-factor authentication, Mirox then asks for a 6-digit code from your authenticator app, or for your passkey. After that you stay signed in, in the web app or in the mobile app, until the sign-in ends.

  • Invite-only registration — New accounts are created through an invitation. If you do not have an invitation, you can submit an access request and the organization's operators are notified to invite you.
  • Email verification — New accounts confirm their address through a verification link before they become active. Accounts created from an invitation are pre-approved.
  • Password reset — You can request a reset link at any time. Completing a reset signs you out everywhere, including the mobile app, and notifies you by email.
  • Sign-in alerts — You receive an email when a sign-in arrives from a network address that is new for your account, and when a sign-in attempt fails. A new browser on a connection you have used before does not trigger an alert.

Info

Mirox never tells an outsider whether an email address has an account. Password-reset and access-request responses look identical whether or not the address exists, so the sign-in page leaks no account information.

Two-Factor Authentication

Two-factor authentication (2FA) adds a second proof of identity on top of your password: a time-based 6-digit code from an authenticator app, or a passkey. Either counts as a second factor; you can also have both.

  • Optional by default — You enable 2FA yourself in your profile, on the Security tab. An organization can require it for access to its plants, see Where a Second Factor Is Required.
  • Setup — You scan a QR code into your authenticator app. 2FA only becomes active after you confirm a first code, so a misconfigured app can never lock you out.
  • At sign-in — When 2FA is active, signing in asks for a current code, or your passkey, after your password. A code that ticks over while you type still works.
  • Signing in more often — An account with 2FA is asked to sign in again after a set time, see Signing In Again With 2FA.
  • Disable / check — You can disable 2FA with a valid code, or check a code from your profile to confirm your app is in sync.

The steps are in the guide Setting Up Two-Factor Authentication.

Backup Code

When you enable 2FA, Mirox shows you one backup code, once. It is your emergency key for the day you lose your authenticator app.

  • You can enter the backup code in one place only: on the code screen at sign-in.
  • Using it signs you in and switches the authenticator app off for your account. No new backup code is issued. You set 2FA up again afterwards and receive a new backup code then.
  • While 2FA is active you can replace the backup code from your profile with a valid code. The old one stops working.

Using the backup code switches the authenticator app off

After you signed in with the backup code, your account has no second factor, unless you also have a passkey. Without one, the device proxy is closed for you, and plants of organizations that require 2FA are hidden until you enable 2FA again or add a passkey.

If you lost both your authenticator app and your backup code, and have no passkey, contact Mirox support. Support can reset your second factor. This signs you out everywhere, and you then sign in with your password and set 2FA up again.

Passkeys

A passkey lets your device prove who you are: Face ID, Touch ID, Windows Hello or a security key instead of a typed code. It is a key that only your device holds and that only works on the real Mirox sign-in page, so it cannot be phished. A passkey is a second factor on its own. You can use it instead of an authenticator app, next to one, or not at all.

  • Add and remove passkeys on your Profile, on the Security tab, in the card named Security. Adding one asks for a current code if you use an authenticator app, otherwise for your password.
  • Sign in with a passkey — The sign-in page offers Sign in with a passkey: you enter your email, confirm on your device, and you are signed in without a password, second factor included.
  • At the 2FA step — If you sign in with your password, the code screen offers Use passkey next to the 6-digit code. Your authenticator code and your backup code keep working as before.
  • E-mail code — If your only second factor is a passkey and you are on a device that does not have it, the code screen offers Send a code by e-mail: a one-time 6-digit code to your account's e-mail address, valid for a short time. The mobile app offers this code too. Accounts with an authenticator app do not get the e-mail code; they have the app and the backup code.
  • Lost all passkeys? Sign in with your password and the e-mail code, then add a new passkey or enable an authenticator app. Nobody has to unlock you.
  • Removing your last second factor — You may remove your last passkey, and you may disable 2FA while a passkey remains. If that leaves your account without a second factor, Mirox warns you: the device proxy is closed for you, and plants of organizations that require 2FA are hidden until you add a factor again.

The steps are in the guide Setting Up Two-Factor Authentication.

How Long a Sign-In Lasts

How long you stay signed in is set by the organization you belong to, in its security policy. If your organization has set nothing, or you belong to no organization, the Mirox defaults apply. They are listed under Platform Defaults.

  • The time runs per sign-in. Each browser and each phone has its own.
  • You follow your organization's rules from the moment you join it.
  • These rules are never passed on to the users of a cooperation partner. Each user follows the rules of their own organization.

Signing In Again With 2FA

If your account has 2FA and your organization has set a 2FA re-check interval, a sign-in also ends a set time after you last proved your second factor on it. Your organization sets this time for the web app and for the mobile app. By default there is no re-check.

A second factor only protects you if it is presented regularly. Without this rule, a browser left signed in on a shared or lost device could be used for weeks without anyone entering a code.

There is no code prompt in the middle of your work. When the time is up you are signed out, and you sign in again with your password and your code. The time then starts again.

What You See When a Sign-In Ends

When the time is up, you are signed out and sign in again: with your password, plus the code or your passkey if you have 2FA. There is no half-open state in which only parts of Mirox work.

In the browser:

  1. During the last 24 hours a countdown appears in the header.
  2. Shortly before the end, Mirox warns you.
  3. At the end you see the sign-in page with a sentence that says why you were signed out.
  4. After signing in you return to the page you were on.

Save before the countdown ends

Text in a form that you have not saved is lost when the sign-in ends. If the countdown is running, save your work first.

In the mobile app you see the sign-in screen and sign in again. Alarm notifications keep arriving in the meantime.

When Your Organization Changes Its Rules

An organization can change its rules at any time, and sign-ins that are already running follow the new rules. If the rules get stricter, a sign-in that is now too old ends a short time after the change. Open browser tabs show a warning first. See When You Change the Rules.

Your Sessions

Every browser and every app you sign in from has its own session, and you stay in control of all of them.

  • See your sessions — The session list on the Security tab of your profile shows each sign-in (browser or app), when it was last active and when it ends.
  • Sign out remotely — You can sign out any other session, or all other sessions at once. Signing out all other sessions also signs out the mobile app. A session you signed out stops working immediately.
  • Self-service identity — Change your password, username, or email from your profile. Changing your password signs out your other sessions; changing your email keeps the old address active until the new one is verified.

The steps are in the guide Managing Your Sessions.

Where a Second Factor Is Required

2FA is your own choice in most of Mirox. In two places a second factor (authenticator app or passkey) is a condition:

  • The device proxy, always. Opening a plant device in the browser through the Proxy requires 2FA on your account and a live sign-in. If you sign out, or your session ends or is signed out anywhere, proxy access ends with it.
  • Plants of an organization that requires 2FA. An organization can require a second factor for access to its plants. Without one you do not see those plants. You stay signed in, and a hint in the header tells you to enable 2FA. As soon as you enable it, the plants are back. This also applies to you on the plants of a cooperation partner that requires 2FA. See Requiring 2FA.

API Tokens

For integrations and scripts that talk to Mirox without a browser, you create API tokens — long-lived credentials scoped to a permission group rather than to your full account.

  • Scoped access — Each token is bound to a permission group so it can do only what that group allows, never more than your own access.
  • Rotation — Rotate a token to issue a fresh secret and retire the old one instantly, with no need to delete and recreate the integration.
  • Visibility — List your tokens to see their permission group, creation and expiry dates, and where they were last used.
  • Not part of the sign-in rules — A token is made for automation. It is never asked for a second factor and it is not ended by the rules for sign-in duration. It keeps working until it expires or you revoke it.

Creating or rotating a token requires that you are signed in yourself — a token can never be used to create or rotate another token. One more rule: while your own organization requires 2FA, you cannot create a new token unless your account has a second factor. See API Tokens for the available permission groups, limits, and usage details.

What the Sign-In Rules Do Not Affect

  • API tokens keep working, as described above.
  • Alarm notifications are always delivered, by email, push, Telegram and webhook. This also holds for plants that are hidden from you because their organization requires 2FA.
  • VPN connections are based on your VPN certificate. They depend neither on a sign-in nor on 2FA. Keep the certificate safe.

The full list is on the Organization Security Policy page.

Rate Limiting

To keep the platform stable and protect accounts from brute-force attempts, sign-in and other sensitive actions (registration, access requests, password reset) are rate-limited per user and per network address.

Warning

When you exceed the limit, further requests are refused for a short time. Build a growing wait between retries into any automated integration so a burst of requests does not lock it out.

Repeated wrong passwords or wrong 2FA codes on a single account are handled separately — see Account Temporarily Locked for how long that pause lasts and how to get back in.

Administrative Access

In rare support situations, a Mirox platform administrator may temporarily access your account to investigate an issue on your behalf.

  • This requires a logged reason and is recorded in a dedicated audit trail.
  • Only standard user accounts can be accessed this way — administrators cannot do so to one another.
  • The access is short-lived and ends automatically; while it is active, a banner makes the access visible.

Working with the Permission System

Authentication answers who you are; the permission system answers what you can reach. The two work together on every request:

  1. Authentication establishes your identity from your session or API token.
  2. The permission system evaluates what that identity is allowed to do.
  3. Every operation is checked against your permissions before it runs.

This separation keeps access control flexible without weakening the guarantee that you only ever see your own resources.

© 2026 Mirox Verwaltungs GmbH. All rights reserved. | Privacy Policy