> For the complete documentation index, see [llms.txt](https://docs.brigge.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.brigge.ai/documentation/account-and-plans/security.md).

# Security

## IP whitelisting

Use the *Security* page to manage all aspects of security for your Brigge account. Guidance is provided in the following sections:

* [IP whitelisting](#ip-whitelisting)
* [Password](#password)
* [Authenticator app (TOTP)](#authenticator-app-totp)
* [Passkeys & hardware keys](#passkeys-and-hardware-keys)
* [Personal access tokens](#personal-access-tokens)
* [OAuth applications](#oauth-applications)

## Introduction

Brigge IP addresses differ by the location where your company account was created. Find the relevant addresses on the [My company](/documentation/account-and-plans/my-company.md) page.

## Password

Use *Password* options to reset your Brigge password. You'll need to provide your current password, then enter and confirm a new one.

{% hint style="info" %}
If you don't remember your current password, use the `forgot your password` option from the Brigge sign-in page. This triggers an email (to your registered email address) with a link to change your password.
{% endhint %}

## Authenticator app (TOTP)

Multi-Factor Authentication (MFA) adds an extra layer of security to your account by requiring a second form of verification when logging in. In this case, access is granted after you provide your username and password, and then enter a one-time code from your chosen authenticator app (Authy, Google Authenticator, etc.).

To register an authenticator app, click the `register` button, scan the QR code, then follow instructions on your device. Next time you log into Brigge, you'll be prompted to enter a code from the authenticator app.

## Passkeys & hardware keys

Passkeys and hardware keys replace username and password as the mechanism for logging into Brigge. Both use the same public/private key cryptography standard [(WebAuthn)](https://en.wikipedia.org/wiki/WebAuthn) - the difference is where the private key lives and how it is 'unlocked'.

<table><thead><tr><th width="363.28125" valign="top">Passkey</th><th>Hardware key</th></tr></thead><tbody><tr><td valign="top">The private key is stored on a device you already own - for example, a phone, laptop, or tablet. It's 'unlocked' using that device - for example, Touch ID or Face ID.</td><td><p>The private key is generated and stored on a physical device (for example, a YubiKey) and <em>only</em> on that device - it's not synced anywhere.</p><p>'Unlocking' is typically a touch/tap (sometimes combined with a PIN) on the device itself.</p></td></tr></tbody></table>

To add a new passkey or hardware key, click `register device`, then choose where to store the key (password manager, iCloud keychain, mobile device or hardware key). Having made your selection, follow on-screen instructions to complete registration.

## Personal access tokens

A personal token can be used to interact with Brigge outside of the UI - for example, via the [API](https://docs.brigge.ai/api-reference/) or an [MCP client](/the-brigge-mcp-server.md#introduction).

To generate a new access token, enter a name (typically some sort of indicator as to where this key will be used), then click the `generate` button. The key is displayed for the first and only time - copy and save it to your preferred password manager.

## OAuth applications

Allow other applications to act on your behalf inside Brigge, through an OAuth authorisation flow