> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/orion-desktop-authenticator/end-user-setup-and-authentication.md).

# End-user setup and authentication

***

{% hint style="info" %}
**Prerequisites** — Orion must be installed on your workstation, and your administrator must have enabled Orion Authenticator in the AdminX portal.
{% endhint %}

### Onboarding your account

Onboarding links your 1Kosmos account to the Orion installation on your workstation. After onboarding, Orion can generate TOTP codes for your account.

**Steps**

1. Sign in to the **AdminX** portal.
2. Click the **Profile** icon in the top right corner and select **My Profile** from the drop-down menu.
3. Navigate to the **Login Options** tab.
4. From the **Setup** drop-down menu, select **Orion Authenticator**.
5. AdminX detects the Orion installation on your workstation and forwards an enrollment request to the agent.
6. Approve the enrollment in Orion.

The onboarded device now appears under the **Login Options** tab of your profile.

{% hint style="warning" %}
**Using Brave?** Disable **Shields** before onboarding. Brave's privacy features block the cross-origin requests Orion needs to be detected by AdminX.
{% endhint %}

### Authenticating with Orion

When you log in to a 1Kosmos-protected application that requires MFA, you'll be prompted to provide a code generated by Orion.

**Steps**

1. Open the 1Kosmos login page and enter your **username**, then click **Next**.
2. Open the **Orion Authenticator** desktop agent.
3. Click **View your Passcode**.
4. Orion generates a TOTP code and displays it on the Accounts page.
5. Copy the OTP code.
6. On the **Choose an authentication method** screen, click **Password & OTP**.
7. Enter your password and click **Next**.
8. On the code entry screen, click **Codes generated by Orion Agent**.
9. Paste the code from Orion.
10. Click **Submit**.

You're signed in.

**Multiple accounts on one workstation**

Orion supports onboarding multiple accounts on a single workstation, subject to the **Max number of accounts onboarded on single device** setting configured by your administrator.

Each onboarded account appears separately in Orion with its own TOTP code.

### **Resetting your enrollment**

If you need to remove your account from Orion (e.g., before reassigning the workstation):

1. Open the Orion agent.
2. Click the **i** icon in the top right corner of the agent window.
3. In the device details section, click **Reset Agent**.
4. Confirm the reset. All enrolled accounts and their associated data are removed.

After reset, you can onboard new accounts. Orion generates a new DID and public key during the next onboarding.

### Troubleshooting

| Issue                           | Resolution                                                        |
| ------------------------------- | ----------------------------------------------------------------- |
| Orion not detected at login     | Confirm the agent is running. Restart if necessary.               |
| Onboarding fails in Brave       | Disable Shields in Brave settings and retry.                      |
| "Authenticator not found" popup | Orion is not installed. Contact your administrator.               |
| Code rejected at login          | Check the code is current (30-second refresh). Verify clock sync. |
| Multiple accounts not appearing | Check device limits with your administrator.                      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/orion-desktop-authenticator/end-user-setup-and-authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.