Settings
Two-Factor Authentication
Protect your account with an authenticator app and backup codes.
Two-factor authentication (2FA) adds a second step when you sign in. After your password or Google/Apple login, you enter a time-based code from an authenticator app (or a one-time backup code).
2FA is optional and per-user. Enabling it only affects your account, not the whole organization.
Enable 2FA
- Open your account menu (avatar) → Account (or profile settings).
- Go to the Security tab.
- Under Two-factor authentication, click Enable 2FA.
- In Google Authenticator, Authy, 1Password, or a similar app, add a new account and scan the QR code shown on screen. If you cannot scan, copy the setup secret and enter it manually (or use Open in authenticator app on a device that handles
otpauth://links). - Enter the 6-digit code from the app and confirm.
- Save the backup codes in a safe place. They are shown only once.
Until you complete step 5, 2FA is not active on your account.
The QR code is generated in your browser from the setup URI — the secret is not sent to a third-party image service.
Sign in with 2FA
| Method | What happens |
|---|---|
| Email & password | After a correct password, the sign-in form asks for your authenticator or backup code. |
| Google / Apple | After OAuth succeeds, you are redirected to a challenge page for your code before the app unlocks. |
Backup codes
- You receive 10 single-use recovery codes when you enable 2FA (or when you regenerate them).
- Use a backup code if you lose your authenticator device.
- Each code works once; the Security tab shows how many remain.
- To get a new set: Security tab → enter a current code → New backup codes. Previous codes stop working.
Disable 2FA
- Open Security in account settings.
- Enter a current authenticator or backup code.
- Click Disable 2FA.
Disabling deletes the stored secret and remaining backup codes. You can enable 2FA again later.
Security notes
- Prefer an authenticator app over SMS (this product uses TOTP only, not SMS).
- Store backup codes offline or in a password manager.
- Use Sign out everywhere on the same Security tab if you suspect unauthorized access.
- API keys and OAuth clients for integrations are separate from interactive login 2FA.