> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/passwordless-for-web-apps/faqs.md).

# FAQs

### General

<details>

<summary>How long is the password reset link valid?</summary>

The reset link sent by email is valid for 30 minutes. For identity verification-based resets, the password must be set within 3 minutes of completing verification.

</details>

<details>

<summary>A user has multiple accounts tied to the same email. What happens when they reset their password?</summary>

The user is prompted to select which account they want to reset the password for before the reset link is sent.

</details>

<details>

<summary>Does enabling mobile-based reset work automatically?</summary>

No. Even if mobile resets were previously working, the Enable users to reset password through Mobile App setting must be explicitly toggled on in AdminX for it to function.

</details>

<details>

<summary>What is the difference between a security key and a platform authenticator?</summary>

A security key is external hardware (USB, NFC, or Bluetooth) that you carry separately — for example, a YubiKey. A platform authenticator is built into your device and uses biometrics such as Face ID, Touch ID, or Windows Hello.

</details>

<details>

<summary>Can a user register more than one FIDO device?</summary>

Yes. Users can register multiple FIDO devices from My Profile. Each registered device appears under the Devices tab.

</details>

<details>

<summary>What browsers support FIDO2/WebAuthn?</summary>

Chrome, Firefox, Edge, and Safari. WebAuthn is not supported in incognito or private browsing windows.

</details>

<details>

<summary>What is the difference between HOTP and TOTP?</summary>

HOTP is event-driven — each code is valid until the next one is generated by pressing the token button. TOTP is time-based and expires after a short window (typically 30 seconds). HOTP does not require clock synchronization, making it better suited for offline or air-gapped environments.

</details>

<details>

<summary>What is the maximum number of tokens that can be imported at once?</summary>

25,000 records per import, with a file size limit of 25MB.

</details>

<details>

<summary>Can one token be assigned to multiple users?</summary>

Yes. A single token can be assigned to multiple users, and a single user can hold multiple tokens.

</details>

<details>

<summary>What happens if a user matches multiple adaptive auth journeys?</summary>

All authentication methods from all matching journeys are presented to the user. If any matching journey has a Deny Access decision, access is denied immediately regardless of other journeys.

</details>

<details>

<summary>Can Grant Access be used without any other PAM?</summary>

It is not recommended. If Grant Access is used exclusively with 1Kosmos Linux PAM, users meeting that condition can log in with just a username, which is a significant security risk. Use it only alongside LDAP PAM for service accounts.

</details>

<details>

<summary>Is there a priority order for journey evaluation?</summary>

No. All journeys are evaluated without priority order. If no journey matches, the default authentication journey is used.

</details>

### User Management

<details>

<summary>What happens after a user is created?</summary>

The user status is set to **Not Invited**. They cannot log in until an administrator sends them an onboarding invite via **Invite User for Passwordless**.

</details>

<details>

<summary>Can I change a user role after creation?</summary>

Yes. Go to the user **Edit Profile** page to update their role. Note that not all fields are editable after creation.

</details>

<details>

<summary>What is the difference between locking and disabling a user?</summary>

Locking is temporary — it suspends the account for a defined period or indefinitely, but can be undone. Disabling (setting Status to Disabled) prevents login entirely until the status is changed back to Active.

</details>

<details>

<summary>Can a Helpdesk Administrator generate onboarding invites?</summary>

Yes, but only with the following permissions granted: user.generate.qr, users.all-users, users.view-user, and users.edit. Without these, the option will not be visible.

</details>

### Aliases

<details>

<summary>How many aliases can be added to a user?</summary>

Up to eight aliases can be associated with a single user account.

</details>

<details>

<summary>Can aliases be used for password reset or QR code login?</summary>

No. Aliases are only supported on the username tab of the login page. They are not supported in QR code flows, Reset Password, Forgot Password, or any other recovery flows.

</details>

<details>

<summary>Can the same alias be assigned to multiple users?</summary>

No. Aliases must be unique across the entire community.

</details>

### Sessions and Devices

<details>

<summary>What happens when a user active sessions are revoked?</summary>

The user is immediately signed out of all devices and must log in again. The E\_SESSIONS\_TERMINATED audit event is triggered.

</details>

<details>

<summary>Can a user unlink their own device?</summary>

No. Device unlinking must be performed by a Community or Helpdesk Administrator from the user Devices tab in AdminX. Helpdesk Administrators require the user.unlink.device permission.

</details>

### Identity Verification (SSPR)

<details>

<summary>Which documents are supported for identity verification-based reset?</summary>

Any valid government-issued identity document supported by the configured IDV journey can be used. The specific journey is selected by the administrator under Reset Password Configurations.

</details>

<details>

<summary>What happens if the user name on the document does not exactly match the account name?</summary>

Administrators can configure name aliases in SSPR settings to handle common name variations — for example, mapping Joe to Joseph. The system uses fuzzy matching to accommodate minor differences.

</details>

<details>

<summary>Is Workday required for SSPR?</summary>

No. Workday is optional. If not enabled, the system defaults to your preferred user store such as Active Directory for attribute lookup.

</details>

### Password History

<details>

<summary>What error does a user see if they try to reuse a previous password?</summary>

The user sees: "The password does not meet the length, complexity, or history requirement of the domain." They must enter a different password that complies with the configured policy.

</details>

<details>

<summary>Does password history enforcement apply to all reset methods?</summary>

Yes. When enabled, it applies across all reset methods — mobile, AdminX, and identity verification.

</details>

### Security Keys

<details>

<summary>What happens if a security key model is disabled?</summary>

Users with that key model can no longer authenticate immediately. Re-enabling the model restores access.

</details>

<details>

<summary>Where do I get the FIDO metadata file for a new security key?</summary>

The metadata file in JSON format is typically available from the key manufacturer developer portal. Contact the manufacturer directly if you cannot find it.

</details>

### Device Enrollment

<details>

<summary>Can a FIDO authenticator registered on one browser be used on another browser?</summary>

Yes, on most platforms. However, cross-browser authenticator use is not currently supported on Mac due to OS limitations.

</details>

<details>

<summary>How does a user remove a registered FIDO device?</summary>

Go to My Profile, locate the device under the Devices tab, click the trash icon, and confirm removal.

</details>

### Token Sync

<details>

<summary>Why is my token not working after it was assigned?</summary>

The token counter on the hardware device may be out of sync with the server. Use the Re-sync Token option in AdminX — the server can correct drift of up to 50 counter steps. If drift exceeds this, manually reset the counter before retrying.

</details>

<details>

<summary>What does a user see on their first login with a hardware token?</summary>

They are prompted with a First-Time Login Setup screen asking them to enter three consecutive passcodes from the device. Once submitted, the token is synced and the user is logged in.

</details>

<details>

<summary>Does the first-time sync need to be repeated for each user if a token is shared?</summary>

No. Syncing is required only once per token, even if it is shared across multiple users.

</details>

### CSV and Data

<details>

<summary>What format is required for the token import CSV?</summary>

Each row must follow: serial number, HOTP secret key, HOTP counter. The counter is optional and defaults to 0 if omitted. No blank rows are allowed between records.

</details>

<details>

<summary>What counter values are not supported?</summary>

Negative numbers, decimals, special characters, and alphabetic values are not supported. The counter must be a non-negative integer.

</details>

### Geo-Based Restrictions

<details>

<summary>Which authentication methods does geo-based restriction apply to?</summary>

Only QR code and push notification. It does not apply to password or OTP-based authentication.

</details>

<details>

<summary>What format must the trusted location be stored in?</summary>

The AD attribute must store the location as a JSON array with lat and lon values. If the data is in a different format, a transformation script can be added at the broker level — contact your 1Kosmos representative for help.

</details>

<details>

<summary>What happens if a user has not enabled location on their mobile device?</summary>

Access is denied and the user sees: "Please enable location permissions for the BlockID app on your mobile device."

</details>

<details>

<summary>What if the browser location is not enabled?</summary>

Access is denied and the user sees: "Please enable your browser location permissions and try again."

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/passwordless-for-web-apps/faqs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.