> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zylon.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication Freshness

> Configure authentication freshness for sensitive workspace and backoffice actions.

<Warning>
  **Upcoming release — Zylon 1.58**

  These docs are published ahead of release so you can prepare your API integrations. The release image is not yet available. For installations running 1.57, use the [1.57 documentation](/en/v1.57/overview).
</Warning>

Authentication freshness requires users to authenticate again when their previous authentication is too old for a sensitive action. It is controlled by the `features.authChallenge` configuration block.

<Warning>
  Authentication freshness is not applied to API requests authenticated with tokens. Token-based integrations continue to work without any changes to their existing flows.
</Warning>

## Enable or disable authentication freshness

Set `features.authChallenge.enabled` to `true` to enable the feature or `false` to disable it. The feature is disabled by default in the chart values.

```yaml theme={null}
features:
  authChallenge:
    enabled: true
```

After changing the configuration, apply it with:

```bash theme={null}
sudo zylon-cli sync
```

When the feature is disabled, the protected actions continue to enforce their normal authorization and permission checks, but they do not require a recent authentication challenge.

## Configure freshness windows

Authentication freshness is configured separately for each risk level. Values are expressed in seconds:

| Risk level | Chart key | Default | Default duration |
| - | - | -: | - |
| Low | `features.authChallenge.maxAgeSeconds.low` | `86400` | 24 hours |
| Medium | `features.authChallenge.maxAgeSeconds.medium` | `3600` | 1 hour |
| High | `features.authChallenge.maxAgeSeconds.high` | `900` | 15 minutes |

For example:

```yaml theme={null}
features:
  authChallenge:
    enabled: true
    maxAgeSeconds:
      low: "86400"
      medium: "3600"
      high: "900"
```

In the generated application configuration, the corresponding block is named `maxAuthAgeSeconds`:

```yaml theme={null}
features:
  authChallenge:
    maxAuthAgeSeconds:
      low: "86400"
      medium: "3600"
      high: "900"
```

Use the key format appropriate to the configuration layer you are editing: `maxAgeSeconds` is the Helm chart values key, while `maxAuthAgeSeconds` is the application configuration key rendered by the chart.

## Risk levels and protected actions

The risk level determines which freshness window is used; it does not replace the user's permissions. The current actions that trigger this check are listed in [Authentication for Sensitive Actions](/en/v1.58/operator-manual/security/authentication-for-sensitive-actions).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.