# Security settings


> What lives on the Security tab, who can reach each part of it, and what belongs to your account instead.
Three things live on the **Security** tab, and they have less in common than the grouping suggests.

| Section | What it is | Who can use it |
| --- | --- | --- |
| Tokens | API tokens for the API, CLI, and MCP server | Owner and Admin |
| SAML SSO | Sign-in through your own identity provider | Owner only |
| Tailscale on screens | Putting your screens on your private network | Owner and Admin |

## API tokens

A token authenticates to the API, the CLI, and the MCP server, and carries the permissions of the account that created it.

It is shown once and never again. See [API tokens](/docs/developers/overview/api-tokens/).

## SAML single sign-on

Enterprise, Owner only. See [Single sign-on](/docs/workspaces/settings/single-sign-on/).

## Tailscale on screens

Despite living under Security rather than Integrations, this is about what your **devices** can reach rather than what the dashboard connects to: it puts screens on your own Tailscale network so they can display internal dashboards and intranet pages.

ScreenlyOS only. See [Reaching your private network](/docs/integrations/network/private-network-access/).

## What is not here

**Passkeys and two-factor authentication** are personal, under your account settings rather than the workspace. They are how *you* sign in, and they work across every workspace you belong to.

**Privacy mode** is per screen, on that screen's Actions tab, not a workspace setting.

The full map is in [Where settings live](/docs/get-started/reference/where-settings-live/).