Overview
CX offers three different ways for your team to log in: Password, Password + MFA, and Password-less. Each option gives a different balance of convenience and security. Firms that run their own identity provider can also connect single sign-on — see the SSO section at the end.
Think of it like locking your office. A simple lock (password) works, but adding a security code (MFA) makes it much safer. Going password-less removes the key entirely and uses a more modern, secure way to confirm identity.
This guide will help you understand each option and choose the right one for your team with confidence.
Key Benefits
Choosing the right login method helps you:
Protect sensitive client and compliance data
Reduce account lockouts and password reset requests
Meet security expectations from clients and partners
Create a smoother login experience for your team
When your login process is clear and secure, your team works faster and with less stress.
How To
Follow these steps to review and select the best login option for your organization.
Step 1: Sign in as an Admin
Go to your Stax.ai login page.
Enter your email address, then sign in.
If you belong to more than one organization, choose the one you want after signing in.
You should now see your main dashboard. If you do not see advanced settings, you may need higher permissions.
Step 2: Open Login Settings
Click your profile icon
Click Advanced Settings.
You should now see the available login options listed at the top of the page:
Password
Password + MFA
Password-less
Take a moment to review them. You're doing great.
Step 3: Understand Each Option
Here's what each one means in simple terms:
Option 1: Password
Users log in with email and password only.
Easiest to set up.
Lowest security level.
Best only for low-risk environments.
Choose this if your team has minimal security requirements and needs the simplest setup.
Option 2: Password + MFA
(MFA stands for Multi-Factor Authentication. This means users verify their identity in two ways.)
Users enter their password.
Then they enter a code from an authenticator app or similar method.
Strong protection against stolen or weak passwords.
Recommended for most organizations.
Choose this if your team handles sensitive client, payroll, or compliance data.
This is the best balance for most TPAs.
Option 3: Password-less
Users do not use a traditional password.
They sign in using a secure link.
Reduces password reset requests.
Modern and secure when set up correctly.
Choose this if your organization wants a more modern login experience and is ready to guide users through setup.
For most teams, Password + MFA is the safest and most practical starting point. If your organization is ready for a more modern approach, Password-less can reduce password stress over time.
Single sign-on (SSO)
If your firm already runs an identity provider, your team can sign in to CX through it instead of using Stax-managed credentials. CX supports SAML 2.0 and has been validated against Microsoft Entra ID, Okta and Google Workspace. Both sign-in directions work: starting from CX, or starting from your identity provider's app portal.
A few things worth knowing before you plan a rollout:
SSO sits alongside your existing login method. Turning it on does not switch off password sign-in.
One identity provider per organization in the current release.
Users need to exist in CX first. By default someone must already have been invited before they can sign in through SSO — an unrecognized account is turned away rather than created. Automatic creation on first sign-in can be switched on for your organization if you'd prefer it.
Note: SSO is rolling out to organizations gradually. If you'd like it enabled for your firm, contact your account manager — they'll walk you and your IT team through connecting your identity provider.
You're making an important decision for your team's security. With the right setup and clear communication, this process will be smooth and successful.