Devices

Devices add a layer of awareness on top of sessions. Pawabase can remember which devices a person has used, warn them when a new one signs in, and let a trusted device skip the second step for a while.

Devices page — Users & auth → Devices, with Configure devices.

A device is identified by an id the app or hosted page keeps (a long-lived value in the browser’s storage). Clearing site data makes a browser look like a new device.

In Studio

Users & auth → Security → Devices. A Recent devices table lists devices people used recently, and Device configuration holds the settings.

Setting	Meaning	Key	Default
Track devices	Recorded at sign-in, by the id the app or hosted page keeps	`directory.devices.track`	on
Email when a new device signs in	Not sent for a person’s first ever sign-in	`directory.devices.notify_new`	off
Remember a device after two-step verification	Days a device may skip the second factor. 0 always asks. Only a device with its own id can be remembered	`directory.devices.remember_days`	0
Devices per person	0 is unlimited. Over the limit, the least recently used is forgotten	`directory.devices.max_per_user`	0

The message people receive is New sign-in in Email templates.

In your app

Remember this device

When the person signs in with a second step, let them tick “Remember this device”:

const result = await pawabase.auth.signInWithPassword({ email, password });
if (result.status === "mfa_required") {
  await result.verify(code);          // the device is remembered when the project allows it
}

result = pb.auth.sign_in_with_password(email=email, password=password, remember_device=True)
if result.status == "mfa_required":
    result.verify(code)

For the Python client, pass remember_device=True on sign_in_with_password and on verify_mfa.

Show and forget devices

const devices = await pawabase.auth.devices.list();
await pawabase.auth.devices.forget(devices[0].id);

devices = pb.auth.devices.list()
pb.auth.devices.forget(devices[0]["id"])

A forgotten device is asked for the second step again next time. Put the list on the account page next to sessions.

Why it helps

New-device emails catch account takeovers within minutes: the real owner sees “New sign-in from Chrome on Windows” and can act.
Remembered devices make two-step verification livable: people confirm on a new device, then not again for 30 days.
Device limits discourage account sharing.

Remembering a device lowers protection on that device. Keep remember_days modest (7 to 30), and require a fresh second step for sensitive actions.

Two-step verification

The second step.

Attack protection

Lockouts.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

In your app

Remember this device

Show and forget devices

Why it helps

Two-step verification

Attack protection

​In Studio

​In your app

​Remember this device

​Show and forget devices

​Why it helps

Two-step verification

Attack protection

In Studio

In your app

Remember this device

Show and forget devices

Why it helps