End-user setup and authentication

This topic is for end users who need to onboard their 1Kosmos account to Orion Authenticator and use it to log in to applications

---

Prerequisites — Orion must be installed on your workstation, and your administrator must have enabled Orion Authenticator in the AdminX portal.

Onboarding your account

Onboarding links your 1Kosmos account to the Orion installation on your workstation. After onboarding, Orion can generate TOTP codes for your account.

Steps

1. Sign in to the AdminX portal.

2. Click the Profile icon in the top right corner and select My Profile from the drop-down menu.

3. Navigate to the Login Options tab.

4. From the Setup drop-down menu, select Orion Authenticator.

5. AdminX detects the Orion installation on your workstation and forwards an enrollment request to the agent.

6. Approve the enrollment in Orion.

The onboarded device now appears under the Login Options tab of your profile.

Using Brave? Disable Shields before onboarding. Brave's privacy features block the cross-origin requests Orion needs to be detected by AdminX.

Authenticating with Orion

When you log in to a 1Kosmos-protected application that requires MFA, you'll be prompted to provide a code generated by Orion.

Steps

1. Open the 1Kosmos login page and enter your username, then click Next.

2. Open the Orion Authenticator desktop agent.

3. Click View your Passcode.

4. Orion generates a TOTP code and displays it on the Accounts page.

5. Copy the OTP code.

6. On the Choose an authentication method screen, click Password & OTP.

7. Enter your password and click Next.

8. On the code entry screen, click Codes generated by Orion Agent.

9. Paste the code from Orion.

10. Click Submit.

You're signed in.

Multiple accounts on one workstation

Orion supports onboarding multiple accounts on a single workstation, subject to the Max number of accounts onboarded on single device setting configured by your administrator.

Each onboarded account appears separately in Orion with its own TOTP code.

Resetting your enrollment

If you need to remove your account from Orion (e.g., before reassigning the workstation):

1. Open the Orion agent.

2. Click the i icon in the top right corner of the agent window.

3. In the device details section, click Reset Agent.

4. Confirm the reset. All enrolled accounts and their associated data are removed.

After reset, you can onboard new accounts. Orion generates a new DID and public key during the next onboarding.

Troubleshooting

Issue	Resolution
Orion not detected at login	Confirm the agent is running. Restart if necessary.
Onboarding fails in Brave	Disable Shields in Brave settings and retry.
"Authenticator not found" popup	Orion is not installed. Contact your administrator.
Code rejected at login	Check the code is current (30-second refresh). Verify clock sync.
Multiple accounts not appearing	Check device limits with your administrator.