Two-factor authentication

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app (1Password, Google Authenticator, Authy and similar) after your password. It is optional, per person.

#Turn it on

1. Open Settings in the dashboard and find Two-factor authentication.
2. Choose Set up, scan the QR code with your authenticator app (or type the key by hand).
3. Enter the 6-digit code the app shows.
4. Save your recovery codes. We show them once.

#Sign in with 2FA

Sign in with your email and password (or Google or GitHub), then enter the current code. Each code works once, so if a code was just used, wait for the next one.

Lost your phone? Choose Use a recovery code on the sign-in step. Each recovery code works once. In Settings you can generate a new set at any time (this cancels the old ones). If you lose both your device and your recovery codes, contact support to have 2FA reset.

#Turn it off

Choose Turn off in Settings and enter your password and a current code.

#Require it for your whole team

Owners can switch on Require for all members in Settings. Members who have not set up 2FA can open Settings to do so, but cannot use the organization until they have. You need 2FA on your own account first. Nobody in a team that requires 2FA can turn it off.

#With the API

The dashboard endpoints are documented in the API reference under "Two-factor authentication". API keys are not affected: they never use 2FA.