Security
Authentication
Authentication is how NNIPA confirms you are who you say you are — before authorization ever gets asked what you're allowed to do. This page covers signing in, multi-factor authentication, and how your session is kept alive.
Signing in
Sign in with your email and password. A new account is verified by email before it can be used, and an organization owner or admin can require every member to enroll in multi-factor authentication before they can sign in at all.
Multi-factor authentication
Once enrolled, signing in asks for a one-time code in addition to your password.
Email code
A one-time code sent to your account email. Works everywhere, no setup beyond a verified email address.
SMS code
A one-time code sent by text message to a verified phone number.
Enroll or change your method under Preferences.
Sessions & tokens
Once you're signed in, NNIPA issues a short-lived access token and a longer-lived refresh token. The app refreshes your access token automatically in the background, so an active session stays signed in without repeatedly prompting for credentials — and signing out, or an admin revoking your session, invalidates both immediately.
Programmatic access uses a separate mechanism entirely — API keys and OAuth 2.0 client credentials, not your personal session. See API Keys.
- A refresh happens silently in the background — you'll only ever see a sign-in prompt if your refresh token itself has expired or been revoked.
- Authentication confirms who you are; it doesn't decide what you can do — that's Authorization.