Account security

mTime protects your account and data through authentication, session management, and access controls.

Authentication methods

mTime supports several ways to sign in:

You can use whichever method you prefer, and you can add a sign-in method to an account you already have. If your workspace is restricted to one sign-in provider, only that provider works there.

Adding a sign-in method

If you signed up with a password and would rather sign in with Google, Microsoft or Visma Connect, add it from your own account:

1. Go to Security in your account settings
2. Under Sign-in methods, choose Add Google, Add Microsoft or Add Visma Connect
3. Sign in at the provider

You stay signed in to mTime throughout — being signed in is what tells us the account is yours, so the address the provider gives back does not have to match your mTime account email.

Only providers your mTime deployment has set up appear as options, and you can have one sign-in method per provider. To swap a provider to a different account there, remove the existing one first.

If the provider account is already used to sign in to a different mTime account, mTime will refuse to add it. Sign in to that account and remove it there first — one provider account can only sign in to one mTime account.

Signing in with a provider you have not added yet

If you choose Sign in with Microsoft (or Sign in with Google ) on the sign-in page and you already have an mTime account at the same email address, mTime adds that sign-in method for you and signs you in, as long as the provider confirms the address is yours. Microsoft confirms it for work accounts on a domain your organization has verified with Microsoft, and for personal Microsoft accounts.

If the provider cannot confirm it, mTime tells you so. Sign in the way you usually do, with your password or passkey, and add the method under Security as described above.

The address each method uses

Each sign-in method shows the email address the provider gave us, which is not always the same as your mTime account email. This is normal where your organization uses aliases: your Microsoft account may present firstname.lastname@company.com while your mTime account is flastname@company.com. Both work; the addresses just differ.

Removing a sign-in method

Under Sign-in methods, choose Remove. You can add it again at any time.

mTime will not let you remove your last remaining way to sign in. If a provider is the only method on your account, set a password or add a passkey first — otherwise removing it would lock you out.

Passkeys

A passkey signs you in with your fingerprint, face, or device PIN instead of a password. It stays on your device (or in your password manager), so there is nothing to remember and nothing to type into a fake sign-in page.

To add one, go to Security, choose Add passkey and follow the prompt from your device. You can add several — one per device — and rename or delete them from the same page. On a phone, Security is under More . To use one, choose Sign in with passkey on the sign-in page.

Passkeys work in current browsers and in the mTime app for Android and iPhone. Where they aren’t available — an older browser, or an older version of the app — the passkey options are hidden and you sign in with your password or a linked account instead. Passkeys you added on other devices stay on your account and are still listed on the Security page.

Email verification

Every account must have a verified email address. When you sign up with email and password, a verification link is sent to your email. You need to click this link before you can use mTime.

If you sign up through an invitation and sign in with Google, Microsoft or Visma Connect, your address is already verified — the invitation was sent to it.

Session management

When you sign in, mTime creates a session that keeps you signed in.

• Sessions last 30 days from the last activity
• If you don’t use mTime for 30 days, you’ll need to sign in again
• Sessions expire automatically — there’s no need to sign out manually, though you can if you prefer

Password reset

If you forget your password or want to change it:

1. Go to the mTime sign-in page
2. Click Forgot your password?
3. Enter your email address
4. Click the link in the reset email to set a new password

The reset link expires after a limited time. If it expires, request a new one.

If your account can also sign in with a passkey or a linked provider, the reset page lists them and offers Also remove these, so only the new password works . Leave it unticked if you just forgot your password. Tick it if you think someone else has access to your account: only the new password will work afterwards. A provider your workspace requires is kept, so you are not locked out of it.

When your password, passkeys or sign-in methods change, mTime emails you. If you didn’t make the change, reset your password and tick the box above.

After 10 wrong passwords in 15 minutes, password sign-in for that email pauses for a while. Wait, or sign in with a passkey or a linked provider.

API key security

API keys are used by service users to access the mTime API. They require careful handling:

• Shown once — API keys are displayed only when created. Copy and store them securely right away.
• Always expire — every key has an expiration date, and no key can last more than a year. An expired key cannot be extended; create a new one.
• Revocation — Revoke any key that is no longer needed or may have been exposed. Revoked keys stop working immediately.
• Traceable — the key list records who created each key, and who revoked it and when, so you can account for every credential after the fact.

Best practices

Follow these recommendations to keep your workspace secure:

• Use strong passwords — Choose a unique, complex password for your mTime account. Consider using a password manager.
• Revoke unused API keys — Regularly review service users and revoke keys that are no longer in use.
• Suspend departed users — When someone leaves your organization, suspend their account promptly to revoke access.
• Limit admin access — Only grant the HR Administrator, Workspace Administrator or Owner role to people who need it, and give each person only the administrator role their job needs. Use the Manager or Employee role for day-to-day users.
• Review user list periodically — Check Admin › Users regularly to make sure only the right people have access.