🔐 Enhanced security requirements
To keep accounts safe, we've built in a number of security measures by default. On top of that, you can enable Enterprise Security - a feature flag that applies a stricter configuration of these measures.
ℹ️ Enhanced security requirements are available only for the Enterprise and EDU Unlimited subscription plans. Check out our subscription plans for more details.
Login methods
The most common way to sign in is with a combination of email and password. This is the base method for signing into Warp Studio, and it's protected by multiple security measures described below. We do recommend setting up one of the other login methods below as an extra layer of protection.
Multi-factor authentication (MFA)
MFA adds an extra layer of security to an account by requiring a code from an external authenticator on top of the password.
Passkey
Passkeys let members sign in without a password, avoiding the risks that come with it. Instead, you confirm your identity with a trusted device. We require that this device verifies your identity and presence with multiple factors, such as a passcode or biometrics.
Federated login / SSO
With federated login, a trust relationship is set up between a third-party Identity Provider, such as Active Directory or OneIdentity - through SAML or OIDC. Once configured, members log in through that service, and Warp Studio uses the information it receives to grant access.
Security measures
We apply the following measures to protect every account:
- Email validation - the account must be activated using a link sent by email.
- Recover account - a password can only be reset using a link sent by email.
- Password complexity - passwords must meet a minimum complexity.
- Password expiration - passwords must be changed after a set amount of time.
- Prevent re-using passwords - previously used passwords can't be reused.
- Lock accounts after failed login attempts - after a number of failed attempts, the account is locked for 1 hour.
- Logout after inactivity - inactive sessions are automatically logged out.
- Prevent information leaking - we never expose whether an account exists.
- Passkey validation - best practices around the use of passkeys are enforced.
- MFA enforcement - we can check and require that all members of a workspace have MFA configured.
- SSO enforcement - members with SSO configured can only log in through that method.
The table below shows how these measures are configured by default (Normal), and how they change when Enterprise Security is enabled.
Setting | Normal | Enterprise Security |
|---|---|---|
Unlock timeout | 1 hour | 1 hour |
Session timeout after inactivity | 24 hours | 4 hours |
Previous passwords remembered | 50 | 50 |
Password expiration | 1 year | 90 days |
Password minimum length | 12 | 12 |
Password uppercase | >=1 | >=1 |
Password lowercase | >=1 | >=1 |
Password digits | >=1 | >=1 |
Password symbols | >=0 | >=0 |
Maximum failed attempts | 10 | 10 |
❗️Enterprise Security is a feature flag and needs to be enabled for your workspace. Reach out to your account manager or contact us to have it turned on.
Updated on: 28/08/2026
Thank you!