> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/orion-desktop-authenticator/faqs.md).

# FAQs

<details>

<summary>What is Orion Authenticator?</summary>

Orion is a desktop authenticator for Mac and Windows that generates TOTP codes for MFA login to 1Kosmos-protected applications. It also acts as a health agent, reporting workstation security posture to inform adaptive authentication policies.

</details>

<details>

<summary>When should I use Orion instead of the 1Kosmos mobile app?</summary>

Use Orion when:

* Mobile devices are restricted in your work environment
* Users prefer desktop authentication
* You need workstation posture signals for adaptive authentication

The mobile app remains recommended for mobile-first organizations.

</details>

<details>

<summary>Which browsers support Orion onboarding?</summary>

Orion supports onboarding from:

* Google Chrome
* Microsoft Edge
* Mozilla Firefox
* Safari (macOS only)
* Brave (with Shields disabled)

</details>

<details>

<summary>Why is a certificate added to my workstation's trust store during installation?</summary>

Orion runs a local HTTPS server on a port between 47061 and 47069 to communicate securely with the 1Kosmos login page in your browser. The trusted certificate is required for the browser to accept this loopback HTTPS connection.

</details>

<details>

<summary>What happens if I try to onboard an account on a workstation without Orion installed?</summary>

The AdminX login page displays a popup notifying you that the agent is unavailable, and onboarding fails. Install Orion first, then retry.

</details>

<details>

<summary>What happens when I reset the agent?</summary>

Resetting removes all enrolled user accounts and their data from Orion. The agent generates a new DID and public key, and you'll need to re-onboard any accounts you want to keep.

</details>

<details>

<summary>Can I perform an in-place upgrade?</summary>

Yes. Run the new version's installer on a workstation that already has Orion installed. The installer overwrites the old binaries while preserving existing enrollments and configuration.

</details>

<details>

<summary>How many accounts can I onboard on one workstation?</summary>

This is controlled by the **Max number of accounts onboarded on single device** setting under **Authentication → Passwordless Login** in AdminX. Contact your administrator for your organization's limit.

</details>

<details>

<summary>How many workstations can a single account be linked to?</summary>

This is controlled by the **Max number of devices linked to an account** setting under **Authentication → Passwordless Login** in AdminX.

</details>

<details>

<summary>Does Orion work offline?</summary>

Orion generates TOTP codes locally, so code generation works offline. However, account onboarding and adaptive authentication policy evaluation require network connectivity to the 1Kosmos platform.

</details>

<details>

<summary>Do I need to restart after installing Orion?</summary>

* **Windows** — Yes, a restart is required after installation and after each upgrade.
* **macOS** — Not typically required.

</details>

<details>

<summary>Why isn't Brave detecting Orion?</summary>

Brave's **Shields** feature blocks cross-origin requests by default. Disable Shields in Brave for the 1Kosmos login page so the browser can detect the local Orion HTTPS server.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/orion-desktop-authenticator/faqs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.