Skip to main content
Chevre provides multiple layers of security controls to protect your workspace data and access — including two-factor authentication, API key management, audit logs, and session policies. Use these tools together to build a defense-in-depth posture that suits your team’s risk tolerance and compliance requirements.

​
Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step to your login flow, requiring both your password and a time-based one-time passcode (TOTP) generated by an authenticator app.

​
Enabling 2FA for Your Account

1

Open Security Settings

Click your avatar in the top-right corner, select Settings, then choose Security in the left sidebar.
2

Start the 2FA Setup

Under Two-Factor Authentication, click Enable 2FA. A setup modal will appear with a QR code.
3

Scan the QR Code

Open your preferred authenticator app — such as Google Authenticator, Authy, or 1Password — and scan the QR code. Alternatively, copy the manual key and enter it directly into your app.
4

Verify the Setup

Enter the 6-digit code currently displayed in your authenticator app into the Verification Code field in Chevre, then click Verify & Enable.
5

Save Your Backup Codes

Chevre will display a set of single-use backup codes. Click Download Codes to save them as a text file, then store that file in a secure location such as a password manager.
Backup codes are shown only once and cannot be retrieved later. If you lose both your authenticator device and your backup codes, you will be permanently locked out of your account. Store your backup codes in a separate, secure location from your primary device.

​
Enforcing 2FA Workspace-Wide

Admins and Owners can require all workspace members to enroll in 2FA before accessing any workspace resources:
  1. Go to Settings → Security → Two-Factor Authentication.
  2. Toggle Require 2FA for all members to On.
  3. Click Save Policy.
Members who have not yet enabled 2FA will be prompted to complete enrollment the next time they log in. They will not be able to access the workspace until enrollment is complete.

​
API Key Security

API keys grant programmatic access to your workspace. Follow these practices to minimize exposure risk.
Never commit API keys to source control, paste them into public forums, or include them in client-side code. If a key is exposed, revoke it immediately and generate a replacement. See the Authentication guide for secure key storage patterns.
Rotate keys regularly. Even keys that have not been compromised should be rotated periodically. Go to Settings → API Keys, click Revoke on an existing key, and generate a new one. Update your integrations immediately after rotating. Use scoped keys. When creating a new API key, assign the minimum required permissions. For integrations that only read data, select the Read Only scope rather than Full Access. This limits blast radius if a key is ever leaked. Label every key. Give each key a descriptive name (e.g., github-actions-ci, data-export-script) so you can quickly identify and revoke the right key if an issue arises.

​
Session Management

Chevre tracks every active login session associated with your account. If you notice an unfamiliar session — or if you lose a device — you can revoke access remotely.
  1. Go to Settings → Security → Sessions.
  2. Review the list of active sessions, which shows the device type, browser, approximate location, and last-active timestamp.
  3. Click Revoke next to any individual session to sign it out immediately.
  4. To sign out all sessions at once — for example, after a suspected account compromise — click Revoke All Sessions. This signs you out everywhere, including your current session.

​
Audit Log

The audit log provides a tamper-evident record of significant events in your workspace, supporting compliance, forensic investigation, and change tracking.

​
Logged Events

Chevre records the following event categories in the audit log:
  • Member management — invitations sent, acceptances, role changes, and removals
  • Authentication — successful logins, failed login attempts, 2FA enrollment, and SSO sign-ins
  • API keys — key creation, rotation, and revocation
  • Workflow changes — workflow creation, edits, activation, deactivation, and deletion
  • Settings changes — updates to workspace name, security policies, integrations, and billing

​
Viewing and Exporting the Audit Log

  1. Go to Settings → Security → Audit Log.
  2. Use the date range picker and event type filter to narrow results.
  3. Click any row to expand the full event detail, including the acting user, IP address, and affected resource.
  4. To export, click Export CSV in the top-right corner. The download includes all events matching your current filter.

​
IP Allowlist (Enterprise Only)

Restrict workspace access to a predefined set of IP addresses or CIDR ranges — for example, your corporate network or VPN egress addresses.
1

Open IP Allowlist Settings

Go to Settings → Security → IP Allowlist.
2

Add Allowed Addresses

Click Add IP Range and enter an IPv4 address, IPv6 address, or CIDR range (e.g., 203.0.113.0/24). Add a label for each entry to document its purpose.
3

Enable the Allowlist

Toggle Enforce IP Allowlist to On and click Save. Login attempts from addresses outside the list will be blocked immediately.
Before enabling the IP allowlist, ensure your own IP address or your organization’s egress range is included. Enabling an allowlist that excludes your current IP will lock you out of the workspace immediately.
If your organization uses SSO, you can enforce both IP allowlisting and SSO together for maximum access control. See the Single Sign-On guide for Enterprise SSO setup instructions.