FAQs

What is Orion Authenticator?

Orion is a desktop authenticator for Mac and Windows that generates TOTP codes for MFA login to 1Kosmos-protected applications. It also acts as a health agent, reporting workstation security posture to inform adaptive authentication policies.

When should I use Orion instead of the 1Kosmos mobile app?

Use Orion when:

• Mobile devices are restricted in your work environment

• Users prefer desktop authentication

• You need workstation posture signals for adaptive authentication

The mobile app remains recommended for mobile-first organizations.

Which browsers support Orion onboarding?

Orion supports onboarding from:

• Google Chrome

• Microsoft Edge

• Mozilla Firefox

• Safari (macOS only)

• Brave (with Shields disabled)

Why is a certificate added to my workstation's trust store during installation?

Orion runs a local HTTPS server on a port between 47061 and 47069 to communicate securely with the 1Kosmos login page in your browser. The trusted certificate is required for the browser to accept this loopback HTTPS connection.

What happens if I try to onboard an account on a workstation without Orion installed?

The AdminX login page displays a popup notifying you that the agent is unavailable, and onboarding fails. Install Orion first, then retry.

What happens when I reset the agent?

Resetting removes all enrolled user accounts and their data from Orion. The agent generates a new DID and public key, and you'll need to re-onboard any accounts you want to keep.

Can I perform an in-place upgrade?

Yes. Run the new version's installer on a workstation that already has Orion installed. The installer overwrites the old binaries while preserving existing enrollments and configuration.

How many accounts can I onboard on one workstation?

This is controlled by the Max number of accounts onboarded on single device setting under Authentication → Passwordless Login in AdminX. Contact your administrator for your organization's limit.

How many workstations can a single account be linked to?

This is controlled by the Max number of devices linked to an account setting under Authentication → Passwordless Login in AdminX.

Does Orion work offline?

Orion generates TOTP codes locally, so code generation works offline. However, account onboarding and adaptive authentication policy evaluation require network connectivity to the 1Kosmos platform.

Do I need to restart after installing Orion?

• Windows — Yes, a restart is required after installation and after each upgrade.

• macOS — Not typically required.

Why isn't Brave detecting Orion?

Brave's Shields feature blocks cross-origin requests by default. Disable Shields in Brave for the 1Kosmos login page so the browser can detect the local Orion HTTPS server.