Account recovery

However good your sign-in is, some users will lose a factor — a phone, an authenticator, a password. Recovery is the safe path back in, without opening a hole an attacker can walk through.

Password reset

Built in and secure by default: the user requests a reset, Atlas emails a one-time, single-use ticket (never a reusable token sitting in a URL), and the user sets a new password. You can revoke all existing sessions on reset so a compromised session can't survive the change. Customize the reset email under Email & SMS templates.

Lost second factor (MFA)

• Backup codes — when a user enrolls TOTP, Atlas issues one-time backup codes. A user who's lost their authenticator signs in with a backup code.

• Admin reset — an admin can reset a user's MFA from the Users screen when they've lost every factor. The reset is written to the audit log.

Encourage users to enroll a recoverable method (an email code) alongside a hardware-bound factor like a passkey, so losing one device isn't a lockout.

Automated lockout

If a user is frozen by the brute-force lockout after failed attempts, an admin can clear the lockout for that account so a legitimate user isn't stuck waiting.

Lost passkey or wallet

A passkey or SIWE wallet can't be "reset" — the private key is gone. This is why Atlas encourages a recoverable fallback and multiple passkeys on separate devices. For an enterprise, the customer's IdP handles recovery via SSO.

Break-glass access

For instances behind enforced SSO or IP restrictions, keep a documented break-glass path — an admin account outside the enforced domain, or a known-good IP rule — so an IdP or network outage can't lock you out of your own instance.

Next

See how apps and events connect to Atlas → Integrations & operations.