Message Ops

Particle Horizon | Message Operations supports local sign-in, single sign-on (SSO), MFA, and step-up verification for sensitive actions.

Sign-in methods

• Local email and password sign-in can be enabled or disabled globally. You sign in with your email address; there is no separate username.
• SSO sign-in can be enabled globally and backed by one or more providers.

Administrators choose which methods are available, and which is the default, under Admin → Authentication (see Administration console).

Signing in

1. Enter your email address on the Sign in card and select Sign In.
2. The platform shows globally enabled methods and domain-based SSO provider hints. Account restrictions are checked when you authenticate:
   • If local sign-in is allowed, a Password field appears. Enter your password and select Sign In again.
   • If SSO providers are available, a Sign In With <provider> button appears for each. When local sign-in is also allowed they are offered as alternatives below a short note.
   • If SSO is the only method and there is exactly one provider, you are sent to that provider straight away.
3. To start again with another address, select Use a Different Email.

There is no self-service, browser-based way to create the platform’s first administrator account. The founding administrator is provisioned once by an operator using a command-line tool against the running platform, before anyone signs in through the browser; if no account has been provisioned yet, contact whoever administers this deployment. Once an administrator account exists, everyone — including that administrator — signs in through the normal sign-in screen.

First sign-in and mandatory MFA enrolment

The initial administrator account is created with MFA required. The first time that account signs in, sign-in pauses with mfa_enrollment_required (see below) until a TOTP authenticator or a passkey is enrolled — the account cannot be used further until enrolment completes. This requirement is set during bootstrap; administrators also control the ongoing MFA policy. The browser moves from password sign-in to the Complete sign-in screen and returns to the originally requested page after successful enrolment. When recovery codes are enabled, the final setup step displays the new codes with Copy Recovery Codes and Download Recovery Codes actions. You must confirm that you have saved them before setup completes because they will not be shown again after leaving the screen.

MFA on sign-in

If a user account requires MFA, sign-in pauses on the Complete sign-in screen in one of two states:

• mfa_required: the user has existing MFA methods and must complete sign-in with an authenticator code (Verify Code), a passkey (Use Passkey), or a recovery code (Use Recovery Code).
• mfa_enrollment_required: the account must enrol a confirmed MFA method before sign-in can finish, using Set Up Authenticator App or Add Passkey.

Supported MFA methods are:

• TOTP authenticator apps
• WebAuthn/passkeys
• Recovery codes for sign-in and step-up fallback

When several methods are available, the challenge opens with your preferred method and provides a Use another method selector. Only confirmed methods that remain enabled by administrator policy are listed. If your preferred method is removed or disabled, sign-in automatically falls back to another available method. You can change the default on the Security tab of your profile when at least two primary methods are usable.

Profile page

Open your profile from the profile menu at the right of the top bar with View Profile. The profile page shows:

• display name, email, and account status
• linked identities and role assignments
• effective permissions
• MFA status and enrolled methods
• password state and timestamps
• API token details (when an administrator has enabled API access for your account)

From the profile page you can also:

• enrol a TOTP authenticator (Add Authenticator)
• enrol a passkey (Add Passkey)
• regenerate recovery codes (Regenerate Recovery Codes)
• delete an MFA credential
• change your password (Change Password)
• generate or regenerate a personal API token (Generate Token / Regenerate Token), if API access is enabled on your account

Adding an authenticator or passkey to an account with an existing factor requires recent MFA verification. If prompted, verify an existing method before continuing setup. Completing setup does not extend the verification window.

Regenerating recovery codes replaces the previous set without signing you out. Save the new codes using the copy or download action and acknowledge that they are stored before continuing. Adding a second authenticator or passkey does not change existing recovery codes and does not show the recovery-code dialog; the dialog appears only for the first MFA method or after you explicitly regenerate the codes.

Time zone

In View Profile, choose an IANA Time zone and select Save to update displayed timestamps. The default is UTC when no preference is saved. This changes presentation, not stored instants. One-time schedule inputs still use your browser-local time zone, while recurring cron expressions use UTC; check the schedule preview before saving.

Personal API tokens

If an administrator has enabled API access for your account, the profile page shows an API token section where you can generate a long-lived token prefixed with sop_. The token is shown once when generated — copy and store it immediately. Regenerating a token immediately invalidates the previous one. Tokens expire after the platform-configured duration (default 90 days).

Personal tokens use manual role assignments only. They do not inherit roles mapped from SSO groups, even if you generated the token during an SSO session. Ask an administrator to assign the intended manual queue scope before using a personal token for broker operations. Local-password sessions also use manual assignments; see SSO role lifecycle.

To use your token, include it as a bearer token in API requests:

Authorization: Bearer sop_yourTokenHere

Step-up verification

Some sensitive actions require a recent MFA verification even if you are already signed in. The UI prompts for step-up verification before continuing. This applies to actions such as:

• saving environment changes
• deleting environments
• updating admin users or roles
• changing authentication policy, sign-in methods, or SSO settings
• rotating sensitive security settings

Signing out

Sign Out in the profile menu clears the browser session and invalidates the current access token.

For unavailable methods, expired sessions or lost MFA access, see common problems.