# Security Settings

> The Security page of an account, in three cards. Change your password inline with a strength meter. Set up an authenticator by scanning a QR code or typing the key, then entering its code. Keep SMS as a backup and view, copy, download or regenerate recovery codes. Add, rename and remove passkeys, and sign out other sessions one by one or all at once.

- Slug: `security-settings`
- Category: [Settings](https://www.assembli.design/category/settings.md)
- Type: block
- Tags: security, settings, two-factor, 2fa, passkeys, sessions, password, recovery-codes, account
- npm dependencies: lucide-react, motion
- shadcn/ui dependencies: @assembli/otp-input, @assembli/password-meter
- Live preview: https://www.assembli.design/preview/security-settings
- Page: https://www.assembli.design/components/security-settings

![Security Settings preview](https://www.assembli.design/thumbnails/security-settings-light.png)

## Props

Other props pass through to the root element.

| Prop | Type | Default | Description |
| --- | --- | --- | --- |
| `account` | `string` | `"you@example.com"` | Used in the recovery codes file and the authenticator label. |
| `issuer` | `string` | `"Northwind"` | Product name for the authenticator entry and the codes file. |
| `passwordChangedAt` | `When \| null` | `null` |  |
| `onChangePassword` | `(current: string, next: string, signOutOthers: boolean) => Promise<void> \| void` |  | Reject with an `Error` whose message says what went wrong, e.g. a wrong current password. |
| `authenticator` | `{ enabled: boolean; addedAt?: When \| null }` | `{ enabled: false }` | Whether the authenticator app is already on. |
| `totpSecret` | `string` | `"JBSWY3DPEHPK3PXPKRUGS4ZANFZSA3TP"` | The base32 secret shown under the QR code during setup. |
| `qrCode` | `React.ReactNode` |  | Your real QR code for the `otpauth://` URL. Without it a placeholder pattern is drawn. |
| `onVerifyAuthenticator` | `(code: string) => Promise<boolean> \| boolean` |  | Check the code from the app. Resolve true to turn it on. |
| `onDisableAuthenticator` | `() => Promise<void> \| void` |  |  |
| `phone` | `string \| null` | `null` | A masked number for text-message codes, or null when none is set. |
| `onAddPhone` | `() => void` |  |  |
| `onRemovePhone` | `() => Promise<void> \| void` |  |  |
| `recoveryCodes` | `RecoveryCode[]` | `[]` |  |
| `onRegenerateCodes` | `() => Promise<string[]>` |  | Issue a fresh set. The old codes stop working. |
| `passkeys` | `Passkey[]` | `[]` |  |
| `onAddPasskey` | `() => Promise<Passkey>` |  | Run the WebAuthn ceremony and resolve with the new passkey. |
| `onRenamePasskey` | `(id: string, name: string) => Promise<void> \| void` |  |  |
| `onRemovePasskey` | `(id: string) => Promise<void> \| void` |  |  |
| `sessions` | `ActiveSession[]` | `[]` |  |
| `onRevokeSession` | `(id: string) => Promise<void> \| void` |  |  |
| `onRevokeOtherSessions` | `() => Promise<void> \| void` |  |  |
| `title` | `React.ReactNode` | `"Security"` |  |
| `description` | `React.ReactNode` | `"Keep your account safe with a strong password, a second st…` |  |

## Install

One-time setup (needs a subscription):

1. Add the registry to the project's `components.json`: `{"@assembli":{"url":"https://www.assembli.design/r/{name}.json","headers":{"Authorization":"Bearer ${ASSEMBLI_API_KEY}"}}}` (merge into `"registries"`).
2. Put an API key from https://www.assembli.design/account in `.env.local` as `ASSEMBLI_API_KEY=asm_…`.

Then install with the shadcn CLI (writes `components/security-settings/security-settings.tsx` and installs dependencies):

```bash
npx shadcn@latest add @assembli/security-settings
```

Registry item JSON: https://www.assembli.design/r/security-settings.json (send `Authorization: Bearer <api key>`)

## Code

> Component source needs an Assembli subscription ($12/month or $96/year) and an API key sent as `Authorization: Bearer <key>`. To get one without copying anything, POST https://www.assembli.design/api/agent/login (or call the MCP tool connect_account), show the user the link it returns, and poll https://www.assembli.design/api/agent/token for the key. Or subscribe at https://www.assembli.design/pricing and create a key at https://www.assembli.design/account.