Skip to main content
A test user tells Strix how to sign in to your application. Sign in to the application yourself. Then select the method that the application asks you for.

​
The four methods

The account signs in with a username (or email) and a password. There is no second factor.Start with this method. It needs the least configuration, and it is the fastest method to verify.Give Strix these items:
  1. The username or the email address of the account.
  2. The password of the account.
The application asks for a code of 6 digits from an authenticator app, for example Google Authenticator, Authy, or 1Password. Some applications call this code a TOTP code.Give Strix these items:
  1. The username and the password of the account.
  2. The setup key of the account. The setup key is the Base32 secret behind the Can’t scan? link on the enrollment page.
Strix makes each code from the setup key. Thus Strix does not need your telephone.Strix cannot use a factor that asks a person to approve the login, for example Duo Push, Okta Verify push, or SMS.
The application sends a numeric code to the email address of the account. Usually the application also asks for a password.Give Strix these items:
  1. A Strix inbox as the email address of the account.
  2. The password of the account, if the application asks for one.
Strix must read the code. Thus Strix must be the owner of the mailbox.

​
An account with MFA needs a Strix inbox

Strix can only complete a second factor that it controls. Strix controls a setup key that you give it, and email that comes to a Strix inbox. Strix cannot read a code that goes to your telephone or to your own mailbox. Do these steps for the Email Code method and for the Magic Link method:
  1. Make a Strix inbox in the test-user dialog. As an alternative, use the provision-inbox endpoint.
  2. Make a new test account with the inbox address, or change the email address of an existing account to the inbox address.
  3. Switch on email login for that account.
The inbox address is also the username of the account. Thus you give the address one time. Strix removes an inbox that no scan used for 30 days. You can make a new inbox at any time.

​
Login verification

Strix verifies the credentials when you save them. The verification is a short run, usually one or two minutes, in the same sandbox that a scan uses. Strix opens the login page, signs in, and reports if it got access to authenticated content. The test user then shows one of two results: verified or failed. Thus you find a bad login before the scan, and not after it. This table gives the usual failures and the correction for each failure: You can start a scan after a failed verification. Strix first shows a warning, because the scan can possibly test no authenticated area. To do a verification with the API, refer to Verify a test user’s login.