Two-factor authentication

Two-factor authentication (2FA) adds a 6-digit code from an authenticator app to your sign-in. Even someone who knows your password, or controls your inbox, cannot get into your account without your device.

It protects your own user account, everywhere you use it. Each person on your team turns it on for themselves, or an admin can require it for the whole organization (below).

Turning it on

1. Open your account menu (top right) and choose Security.
2. Click Set up two-factor authentication.
3. Scan the QR code with any authenticator app (1Password, Google Authenticator, Authy, and others all work). If you cannot scan, type the setup key in manually.
4. Enter the 6-digit code your app shows, and confirm with your account password. We ask for your password so that nobody holding only a browser session can turn 2FA on with their own device. If your account signs in by email link instead of a password, we email you a one-time confirmation code to enter here: the email is what proves it's you.
5. Leave "Sign out my other sessions" ticked (recommended): any other browser signed in to your account is signed out the moment 2FA turns on.

You will get 10 recovery codes the moment it is confirmed. Copy them, or download them as a CSV, and save them somewhere safe: they are shown once and never again.

Signing in with it

After your password (or a sign-in link), you enter the current code from your app. Tick "Remember this device for 30 days" on a computer that is yours and that browser skips the code until the 30 days pass. You can see and forget all remembered devices from the Security page at any time. Sign-ins after a password reset always ask for the code, remembered device or not.

Recovery codes

Each recovery code unlocks one sign-in if you lose your authenticator. When you use one, it is gone (and we email you that it was used). You can regenerate a full set of 10 from the Security page at any time, which also cancels all your old codes.

If you lose both your authenticator and your recovery codes, ask an admin on your team: anyone who can manage members can reset your 2FA from the Team page after verifying it's really you. The reset turns your two-factor off, cancels your recovery codes and remembered devices, signs you out everywhere, and emails you about it. Then you sign in and set it up fresh. An organization owner who is locked out contacts support (a platform operator performs the same audited reset).

Requiring it for your whole team

An admin can turn on "Require two-factor authentication for all members" under Settings → Preferences → Security. Everyone gets 7 days to enrol (someone who joins later gets 7 days from joining); after that, the app takes an unenrolled member to their Security page until they set it up. The Team page shows a shield next to enrolled members and flags who still needs to act.

Turning it off

From the Security page, confirm with your current password (or a current authenticator code if your account has no password). Your sign-in goes back to password only, and your recovery codes and remembered devices are deleted.

Good to know

• You get an email for every security change: 2FA turned on or off, recovery codes regenerated, a recovery code used, or an admin reset. If you didn't do it, act on that email immediately.
• A password reset does not bypass 2FA. The reset email can change your password, but the sign-in after it still asks for your code.
• Sign-in links do not bypass it either. The emailed link counts as your first step; the code is still required.
• Codes are one-time. A code that just worked cannot be reused, even inside its 30-second window.
• Wrong codes are strictly limited. Five wrong codes end the attempt, and too many attempts pause sign-in for the account for a few minutes.
• API keys are separate. 2FA protects interactive sign-ins; requests made with an API key are authenticated by the key itself and are not affected. Treat keys with the same care as passwords.