Confirming sensitive actions
Elaichi asks you to prove it is still you before it applies a change that could lock someone out or give access away. A Confirm it's you dialog appears, and the change goes through only after you verify.
This protects the account itself. Someone who finds your signed-in laptop still cannot turn off your two-factor authentication, create an API token or remove a member.
Where to find it: the dialog opens by itself when you start a sensitive change, for example under Settings → Security, Settings → API tokens or Settings → People.
Confirm a change
- Start the change. The Confirm it's you dialog opens.
- Verify with the method the dialog shows:
- Use your passkey. Approve the prompt on your device. If the prompt does not appear or you dismiss it, choose Use your passkey again.
- Authenticator app. Enter the six-digit code, or choose Use a recovery code.
- Emailed code. Enter the six-digit code Elaichi sent to your email. Choose Resend code if it does not arrive.
- Choose Verify, or finish the passkey prompt.
The change goes through right away. A confirmation covers that one action only. If you choose Cancel, nothing changes.
To use a different method, choose Use another way in the dialog. It lists only the methods you can use for that action.
Actions that always ask
For these actions, Elaichi asks every time, even if you just confirmed another change.
| Action | Where |
|---|---|
| Create or revoke an API token | Settings → API tokens |
| Create a SCIM token | Settings → SSO and SCIM |
| Invite a member, or resend an invite | Settings → People |
| Turn on or turn off two-factor authentication | Settings → Security |
| Regenerate recovery codes | Settings → Security |
| Add or delete a passkey | Settings → Security |
| Delete the organization | Settings → Organization |
Actions that ask once for 10 minutes
For these actions, Elaichi skips the dialog when you verified with a passkey or an authenticator app in the last 10 minutes. A series of changes then costs one confirmation. Elaichi shows a message such as "Confirmed with your verification from 3 min ago" when it skips the dialog. A code you confirm by email does not start this 10-minute period.
| Action | Where |
|---|---|
| Remove a member from the organization | Settings → People |
| Change a member's roles | Settings → People |
| Delete a role | Settings → People |
| Delete a team | Settings → People |
| Revoke a pending invite | Settings → People |
| Create, edit, verify or delete a verified domain | Settings → Domains |
| Create or edit an SSO connection | Settings → SSO and SCIM |
| Create or edit a group mapping | Settings → SSO and SCIM |
| Turn off Require two-factor authentication | Settings → Organization |
| Approve or deny an access request | Governance → Access requests |
What to know
- Which methods you can use. Elaichi offers the strongest method you have set up first: a passkey, then an authenticator app. The emailed code is the last resort. Elaichi does not offer it for actions that remove or weaken a sign-in protection, and it does not offer it while an organization you belong to requires two-factor authentication.
- No second factor yet. If you have no passkey and no authenticator app, Elaichi sends a code to your email for actions that allow it.
- Deleting your last passkey. Elaichi asks for an authenticator code, because the passkey cannot confirm its own deletion. Set up an authenticator app first if you do not have one.
- A new passkey added by email. If you added a passkey by confirming with an emailed code, that passkey cannot confirm actions that remove or weaken a sign-in protection for 72 hours. The dialog shows the time it becomes available.
- Recovery codes. A recovery code you use here is gone afterward, as at sign-in.
- A wrong or expired code fails. Try again with a fresh one.
- Browser sessions only. An API token cannot confirm these actions, and neither can an AI client over MCP. Elaichi refuses them there.