How Flidu Protects Sessions
Flidu has no passwords. See how sign-in codes, Google, passkeys and two-factor protection work, how to review and end sessions, and which changes ask you to verify again.
Flidu accounts have no passwords. You sign in with a one-time code sent to your email, with Google, or with a passkey, and you can add two-factor protection on top. Everything described here lives on one page: open the account menu at the top of the dashboard and choose Profile Settings. These settings are personal, so they follow you into every workspace you belong to.
Signing In Without A Password
- Email code. Choose Continue with Email, enter your address and click Email Me a Code. The 6-digit code works once and expires after 10 minutes. If you ask for another, use the newest one.
- Google. Continue with Google opens Google’s own sign-in screen. It works for a Google account that uses the same verified email as your Flidu account.
- Passkey. After you type your email, Use a Passkey lets your device confirm it is you with Face ID, Touch ID, a PIN or a security key. The passkey has to belong to the email you typed.
Signing in never creates an account, and the code screen shows the same message whether or not an account exists for the address you typed. Code requests and code attempts are limited, so after several in a row the page asks you to wait before trying again.
Turn On Two-Factor Protection
With protection off, an email code alone opens your account. With it on, signing in with an email code or Google shows a One More Step screen that asks for your authenticator app or passkey before the dashboard opens. Signing in with a passkey already counts, so no second step is asked.
- In Profile Settings, find the Two-Factor Protection card and click Turn On Protection.
- Choose Add a Passkey or Set Up an Authenticator App.
- For a passkey, click Continue, confirm on your device, give the passkey a name and click Save Passkey.
- For an authenticator app, scan the QR code or type the setup key, click I’ve Scanned It, enter the 6-digit code from the app and click Verify and Enable.
- After an authenticator app is verified, save the recovery codes that appear, tick the confirmation box and click Done.
The card shows On as soon as one method is verified. You can add more than one passkey, for example one per device. An account has one authenticator app at a time. Adding a passkey needs a sign-in from the last 10 minutes: if the dialog shows Sign in again to add a passkey, click Sign In Again, sign back in and repeat the step.
Recovery Codes And Restricted Sessions
Recovery codes are issued when you set up an authenticator app. You get 10, each works once, and the set is shown a single time, so use Copy All or Download .txt before you close it. Afterwards the Recovery Codes card shows only how many are left. Regenerate issues a new set and stops every older code from working. An account protected by passkeys alone has no recovery codes.
Signing in with a recovery code opens a restricted session, and a notice across the dashboard says so. Your widgets, assistants and data keep working, but billing changes, team changes, ownership transfer and removal requests, changing your sign-in email, connecting or disconnecting Google, removing security methods, regenerating recovery codes and signing out other sessions are blocked. Click Set Up Two-Factor Again and add a passkey or verify a new authenticator app to lift the restriction. A restricted session is short-lived, so do this straight away.
Review And End Sessions
The Sessions & Devices card lists every place you are signed in. Each row shows the device and browser, the day you signed in and when it was last active. The one you are using is marked This Device. Flidu shows a device label only; no network address is stored with a session or displayed.
- Sign Out Session ends one other session.
- Sign Out All Other Sessions ends everything except the device you are on.
- Sign Out ends the session on this device only.
Signing a session out takes effect immediately: that device has to sign in again before it can load anything else. Sessions also expire on their own when a device goes unused, and that device is then asked to sign in again.
Changes That Ask You To Verify Again
Being signed in is not enough for the changes below. A Verify It’s You dialog opens first, and each verification works once, for that one change. Recovery codes cannot be used here.
| Change | How You Verify |
|---|---|
| Change your sign-in email | Authenticator app or passkey |
| Remove a passkey or the authenticator app | Authenticator app or passkey |
| Regenerate recovery codes | Authenticator app or passkey |
| Connect or disconnect Google | Authenticator app or passkey |
| Transfer workspace ownership | Authenticator app, passkey or a fresh email code |
| Request workspace removal | Authenticator app, passkey or a fresh email code |
Security Notices By Email
Flidu sends a notice to your sign-in email when the security of your account changes, so a change you did not make does not go unnoticed:
- A passkey is added or removed.
- An authenticator app is set up or removed. Removing it also signs out your other sessions and stops your recovery codes from working.
- A recovery code is used to sign in, or the codes are regenerated.
- Google is connected or disconnected.
- You sign out all other sessions.
- Your sign-in email changes. The old and the new address both get a notice and your other sessions are signed out. Your current email keeps working until the new one is verified.
If Something Looks Wrong
- You see a session you do not recognise. Sign it out, then follow I Think Someone Else Accessed My Account.
- A code does not arrive. See My Sign-In Code Is Not Arriving.
- You lost your authenticator app or passkey. See I Lost Access To My Two-Step Verification.