> ## Documentation Index
> Fetch the complete documentation index at: https://q.odontox.io/llms.txt
> Use this file to discover all available pages before exploring further.

# First Login & Security

> Set your OdontoX password, enable two-factor authentication with passkeys or TOTP, and review session timeout, single-session, and lockout security policies.

## Overview

After your account is approved, your first login involves setting a secure password and
configuring two-factor authentication (2FA). The platform enforces strong security defaults
to protect sensitive patient data and clinic operations.

## Setting your password

<Steps>
  ### Open the invitation link

  Check your email for the password setup invitation from the platform. Click the link to open
  the password setup page.

  <Warning>
    The invitation link expires after **7 days**. If the link has expired, ask your clinic
    Admin to resend the invitation from the staff management panel.
  </Warning>

  ### Choose a strong password

  Enter a password that meets the following requirements:

  * Minimum **8 characters**
  * Use a mix of uppercase, lowercase, numbers, and symbols for best security

  <Tip>
    Use a password manager to generate and store a strong, unique password for your
    your account.
  </Tip>

  ### Confirm and save

  Re-enter your password to confirm, then click **Set Password**. You will be redirected
  to the login page.
</Steps>

## Configuring two-factor authentication

After your first successful login, the platform prompts you to set up two-factor authentication
(2FA). This adds a second layer of security beyond your password.

### Available 2FA methods

<CardGroup cols={3}>
  <Card title="Email OTP" icon="envelope">
    A 6-digit code sent to your registered email. This is the **default method** enabled
    for all accounts.
  </Card>

  <Card title="Authenticator App" icon="mobile">
    Time-based one-time passwords (TOTP) via apps like Google Authenticator or Authy.
  </Card>

  <Card title="Passkeys" icon="fingerprint">
    Biometric authentication using FaceID or TouchID via the WebAuthn standard.
  </Card>
</CardGroup>

### Email OTP (default)

Email OTP is automatically enabled when you set up 2FA. Each time you log in:

1. Enter your email and password
2. A **6-digit code** is sent to your registered email
3. Enter the code on the verification screen

<Note>
  Email OTP codes are valid for **10 minutes**. If the code expires, request a new one
  from the login screen.
</Note>

### TOTP authenticator app

For faster and offline-capable authentication, configure a TOTP authenticator app:

<Steps>
  ### Navigate to security settings

  Go to **Settings > Security > Two-Factor Authentication**.

  ### Select authenticator app

  Choose **Authenticator App** as your 2FA method.

  ### Scan the QR code

  Open your authenticator app (Google Authenticator, Authy, or any TOTP-compatible app)
  and scan the QR code displayed on screen.

  ### Enter the verification code

  Type the 6-digit code from your authenticator app to confirm the setup.
</Steps>

### Passkeys (FaceID / TouchID)

Passkeys provide the most seamless login experience using your device's biometric
capabilities:

<Steps>
  ### Navigate to security settings

  Go to **Settings > Security > Passkeys**.

  ### Register a passkey

  Click **Add Passkey** and follow your browser's prompts to register your device using
  FaceID, TouchID, or another WebAuthn-compatible method.

  ### Confirm registration

  Once registered, you can use your passkey as a second factor during login.
</Steps>

<Note>
  You can register **only one passkey** per account. If you need to switch devices,
  remove the existing passkey from **Settings > Security** before registering a new one.
</Note>

## Session security policies

The platform enforces several session-level protections to keep your account safe:

### Login lockout

If you enter the wrong password **5 times** in a row, your account enters a
**10-minute cooldown** period. During this time, no login attempts are accepted —
even with the correct credentials.

<Note>
  The lockout timer resets automatically after 10 minutes. If you are locked out
  frequently, consider resetting your password.
</Note>

### Single-session enforcement

The platform allows only **one active session per user** at a time. If you log in on a new
device or browser, your previous session is terminated automatically.

This means:

* You cannot be logged in on your desktop and phone simultaneously
* Logging in on a new device immediately logs you out of the old one
* There is no warning before the old session is ended

### Session timeout

Your session automatically expires after **30 minutes of inactivity**. When your session
times out:

1. You are redirected to the login page
2. Any unsaved work may be lost
3. You must re-authenticate with your password and 2FA

<Tip>
  Save your work frequently, especially if you step away from your desk. The 30-minute
  timeout is designed to protect patient data in shared clinic environments.
</Tip>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can I disable 2FA?">
    No. Two-factor authentication is mandatory for all your accounts to comply with
    data security requirements for healthcare platforms.
  </Accordion>

  <Accordion title="What if I lose my phone with the authenticator app?">
    Contact your clinic Admin or our support team to regain access. They can reset
    your 2FA so you can reconfigure it from a new device.
  </Accordion>

  <Accordion title="Can I use multiple 2FA methods at the same time?">
    Yes. You can have email OTP, an authenticator app, and passkeys all configured
    simultaneously. During login, you choose which method to use.
  </Accordion>

  <Accordion title="What happens if my invitation link expires?">
    Ask your clinic Admin to resend the invitation from the staff management panel. The
    new link resets the 7-day expiry window.
  </Accordion>
</AccordionGroup>

## Related articles

* [Signup & Approval](/getting-started/signup-and-approval) — How to create your account
  and get approved
* [Roles & Permissions](/getting-started/roles-and-permissions) — Understand what you can
  access based on your assigned role
* [Inviting Staff](/getting-started/inviting-staff) — How Admins send invitations and
  manage the onboarding flow