Sign-in and bot protection
Platform → Sign-in and bot protection has the installation's security settings: how admins sign in,
and the bot check on forms and portals. Only Platform Administrators see it (installation.settings). The other
pages under Security are Roles, for who may do what, and IP allowlists, for the
servers that server-mode forms accept.
Two-factor sign-in
| Setting | What it decides |
|---|---|
| Admins must use two-factor authentication | On by default. Platform Administrators set up an authenticator app or a passkey before they can use the desk. Everyone else chooses for themselves under Sign-in and security in their own settings. See Users. |
Bot protection
Cloudflare Turnstile is an invisible bot check on forms and portals. It needs a site key and a secret key from Cloudflare.
- In Cloudflare, add a Turnstile widget for the domains your forms and portals are on.
- Paste the site key and secret key here.
- The page shows the widget with the site key; when it passes, Check the keys asks Cloudflare whether the secret matches.
- Pick Save.
Forms and portals then use it unless they turn it off. Without keys, or with Cloudflare's test keys, Still to do under Platform → Installation says so.
[!NOTE] Every change is in the audit log.