Guide Step Up

Confirming critical actions

For actions that are hard to undo or that change who can get in, MowDeck asks you to confirm it is really you, even though you are signed in. A sheet opens: Confirm with passkey (Face ID, Touch ID, Windows Hello, your phone) or type your password. After that your action simply continues.

When does it ask?

• deleting a mower or removing a linked Mammotion account,
• creating an API token,
• creating or removing users, changing roles and admin rights, setting a sub-user's password,
• removing a passkey, unlinking GitHub or Apple, adding a passkey or linking one,
• signing out another device or all other devices, turning off the alerts about new sign-ins (Your security page),
• deleting the account.

Your confirmation counts for 5 minutes (your administrator can change that). Signing in counts as a confirmation too, so right after signing in it does not ask again.

In the iOS and Android app

Passkeys cannot be used inside the app, so the sheet only asks for your password there.

API tokens

API tokens, for example the one Home Assistant uses, cannot confirm anything. These actions are refused for them with the message that an interactive sign-in is needed; do them in the web app.

---

Mirrored from docs/guides/step-up.md at commit 0445bc6762d63c1f0bd7e978174ed00037baf794. Edit the file in the repository, not this wiki page.