--- title: "Access the proxies with device authorization" slug: "how-to-access-proxies-with-device-authorization" updated: 2026-11-06T19:31:49Z published: 2026-11-06T19:31:49Z canonical: "docs.senhasegura.io/how-to-access-proxies-with-device-authorization" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # Access the proxies with device authorization Terminal Proxy and RDP Proxy ask you to approve the sign-in with your organization's identity provider when your administrator enables device authorization. You approve it on a phone or another computer. Device authorization also works on Segura™ SaaS and with Proxy 2.0. Segura™ does not ask for its MFA token when you sign in this way. If your administrator requires an MFA token to start sessions, you still enter it. ## Requirements - An administrator has enabled device authorization on an OpenID provider. See [Manage OpenID providers](/v4-2/docs/how-to-manage-openid-providers). - Your Segura™ username matches the identity provider claim set by your administrator. - A phone or computer with a browser, where you can sign in to the identity provider. ## Sign in to Terminal Proxy 1. In your SSH client, connect to the Terminal Proxy address with your Segura™ username. 2. When the **Segura Terminal Proxy** message appears, open the link on any device, or scan the QR code. The link is under **1. On your computer or mobile device, go to:**. 3. If the identity provider page asks for a code, enter the code shown under **2. Enter the following code:**. 4. Sign in to the identity provider and approve the sign-in. 5. In the SSH client, press **Enter**. The session opens after the identity provider confirms the approval. ## Sign in to RDP Proxy 1. In your Remote Desktop client, connect to the RDP Proxy address with your Segura™ username. 2. On the **External Authentication** screen, open the link on any device, or scan the QR code. To open the link on the same computer, click **Copy URL** and paste it in a browser. 3. If the identity provider page asks for a code, enter the code shown under **2. Enter the following code:**. 4. Sign in to the identity provider and approve the sign-in. The RDP Proxy screen continues after the identity provider confirms the approval. To stop, click **Cancel**. ## Sign in to Database Proxy Database Proxy does not use device authorization. A database client can only send a password to the server, so there is no link, code, or QR code to approve. If you sign in to Segura™ through your identity provider and have no local password, use a temporary token as the password: 1. Generate a temporary token. See [How to generate a temporary token for proxy access](/v4-2/docs/pam-sessionmanagement-how-to-generate-a-temporary-token-for-proxy-access). 2. In your database client, configure the connection to Segura™, not directly to the database: - **Host:** the Segura™ address. - **Port:** the Database Proxy port for your database type. See [How to modify Database Proxy port number](/v4-2/docs/pam-session-how-to-set-up-a-database-proxy). - **Database:** the name of the target database. - **User name:** `vault_username[credential_username@device_hostname{database_port}]`. For an example with DBeaver, see [How to configure and start a PostgreSQL session with DBeaver](/v4-2/docs/pam-session-how-to-configure-and-start-a-postgresql-session-with-dbeaver). - **Password:** the temporary token. 3. Connect. Use TLS for the connection when your database client supports it, so the token does not travel in clear text. For details, see [How to access Database Proxy with a temporary token](/v4-2/docs/pam-sessionmanagement-how-to-access-database-proxy-with-a-temporary-token). ## If the sign-in fails The sign-in fails when: - The code expires before you approve it. - You deny the sign-in. - Your identity provider account does not match your Segura™ user. Terminal Proxy shows **Invalid username or password** and closes the connection. Start a new connection to get a new code. If the failure repeats, ask your administrator to confirm that your Segura™ username matches your identity provider account. ## Related topics - [Device authorization](/v4-2/docs/about-device-authorization) - [How to connect to a remote device with RDP Proxy](/v4-2/docs/pam-session-how-to-connect-to-a-remote-device-with-rdp-proxy) - [How to make an SSH connection via Terminal Proxy](/v4-2/docs/pam-session-how-to-make-an-ssh-connection-via-terminal-proxy) - [Database Proxy](/v4-2/docs/pam-session-about-database-proxy) - [About proxy access with temporary tokens](/v4-2/docs/pam-sessionmanagement-about-proxy-access-with-temporary-tokens) - [How to perform an SSH connection via Terminal Proxy](/v4-2/docs/segura-saas-ssh-connection-terminal-proxy) (Segura™ SaaS) - [How to establish an RDP connection via RDP Gate](/v4-2/docs/segura-saas-rdp-connection-rdp-gate) (Segura™ SaaS) - [How to make an SSH connection via Terminal Proxy 2.0](/v4-2/docs/pam-session-how-to-make-an-ssh-connection-via-terminal-proxy-20) - [How to connect to a remote device with RDP Proxy via Proxy 2.0](/v4-2/docs/pam-session-how-to-connect-to-a-remote-device-with-rdp-proxy-via-proxy-20)