Authentication: Announcing 2FA, MFA and Passkeys on Koyeb

Today, we're excited to introduce a new and improved authentication experience for all StellarStack users, bringing stronger security and a smoother way to access your StellarStack accounts.

When we first built StellarStack, we implemented a simple internal authentication system that was easy to maintain and worked well for our early users. As our platform grew, we recognized the need to redesign our authentication stack to meet the increasing security demands of teams using StellarStack.

To offer advanced features and a seamless sign-in experience, we've rolled out a fully redesigned authentication system with robust security features, including 2FA, MFA (Multi-Factor Authentication), and passkeys. Learn more about these features and how to get started below.

Why Stronger Authentication Matters

Passwords alone are no longer enough. The vast majority of account breaches start with stolen, reused, or phished credentials—and once an attacker has a valid password, nothing else stands in their way. By adding a second factor or removing passwords entirely, you close off the single most common path attackers use to gain access. For teams running production workloads on StellarStack, this isn't just a personal safeguard; a compromised account can expose deployments, secrets, and customer data. Our goal with this release is to make best-in-class account security the default, not an afterthought you have to configure under pressure after something goes wrong.

2FA And Multi-Factor Authentication

2FA and MFA add extra layers of protection to your StellarStack account by requiring more than one step to verify your identity. Starting today, you can secure your account with a second verification step using any standard authenticator app.

The principle behind multi-factor authentication is simple: combine something you know (your password) with something you have (your phone or a hardware key) or something you are (a fingerprint or face scan). Even if one factor is compromised, an attacker still can't get in without the others. Most authenticator apps—such as Google Authenticator, Authy, or 1Password—generate time-based one-time passwords (TOTP) that rotate every 30 seconds, so the code an attacker might intercept is useless moments later.

When you enable 2FA, we also issue a set of one-time backup codes. Store these somewhere safe, like a password manager: they're your way back into your account if you ever lose access to your authenticator device. Enabling 2FA significantly reduces the risk of account compromise and is the fastest way to strengthen your account security.

How To Enable 2FA And MFA

To enable MFA, go to your account settings and scroll to the "Multi-Factor Authentication" section. From there, you can set up an authenticator app in a few simple steps: verify your identity, scan the QR code, and confirm the code from your app.

The whole process takes less than two minutes. Once your authenticator app reads the QR code, it begins generating rotating six-digit codes for StellarStack. You'll enter the current code once to confirm the link, and from that point on you'll be prompted for a fresh code each time you sign in from a new device or browser. We recommend enrolling at least two factors where possible—for example, an authenticator app plus your saved backup codes—so that losing a single device never locks you out. For team accounts, administrators can also require MFA across the entire organization, ensuring every member meets the same security bar.

For a detailed walkthrough, you can follow our full step-by-step guide in the MFA documentation.

Passkeys

StellarStack now supports passkeys, letting you sign in without a password. A passkey is a secure, encrypted digital key stored in your password manager, providing a safer and faster way to authenticate your identity.

Passkeys leverage built-in device security—such as fingerprint, biometric, facial recognition, or hardware keys like YubiKeys—to provide ultra-fast, phishing resistant, and seamless sign-in experiences across all your devices.

Under the hood, passkeys are built on the FIDO2 and WebAuthn standards. When you create a passkey, your device generates a cryptographic key pair: the private key never leaves your device, while only the public key is shared with StellarStack. Because there's no shared secret stored on our servers, there's nothing for an attacker to steal in a database breach and nothing to phish—a passkey only works on the legitimate StellarStack domain it was created for. This makes passkeys fundamentally resistant to the credential-stuffing and phishing attacks that plague traditional passwords. And because most password managers and operating systems now sync passkeys securely across your devices, you get the security of a hardware key with the convenience of signing in using just your fingerprint or face.

How To Set Up Passkeys

To create a passkey for a new StellarStack account, select "Continue with passkey" on the signup page and allow the prompt to securely create and store your passkey in your password manager. Once created, your account will be ready to sign in with a passkey.

To log in to an existing StellarStack account using a passkey, enter your email, select "Sign in with passkey," and choose the passkey from your password manager when prompted.

Choosing the Right Method for You

With several options now available, here's how we'd suggest thinking about them. If you want the strongest, most convenient protection, start with a passkey—it removes the password entirely and defends against phishing by design. If you prefer to keep a password but add a safety net, enable 2FA with an authenticator app and save your backup codes. For organizations with compliance requirements, combining passkeys for everyday sign-in with enforced MFA as a fallback gives you both convenience and a verifiable security policy. Whichever path you choose, the most important step is simply to enable more than just a password today.

Coming Soon: Google Social Login

This authentication update is just the beginning. Our goal is to provide you and your team with a the security tools needed to build production-grade applications on StellarStack.

Next, we're working on supporting Google login, making it easy to sign in to StellarStack using your existing Google account. Beyond Google, we're evaluating additional identity providers and enterprise SSO via SAML and OIDC, so larger teams can centralize access management through the tools they already use. We're also exploring granular session controls—letting you review active sessions, revoke access from lost devices, and set policies for how long sessions remain valid.

Security is never "done," and we treat it as an ongoing commitment rather than a one-time feature launch. We'll continue hardening every layer of the platform and giving you the controls to protect your team without slowing it down. We can't wait to bring these improvements to your workflow. Stay tuned for these updates and more.