Two-factor authentication
TOTP with recovery codes, enforced at the login challenge.
- 1Open Account → Security
Scan the QR code with any authenticator app.
- 2Confirm with a code
Two-factor is only enabled once you have proved the app works.
- 3Store the recovery codes
Single-use codes for when you lose the device. Keep them somewhere that is not the device.
Recovery codes are the only way back
Lose both the authenticator and the codes and support cannot simply switch two-factor off for you - that would make it worthless.
Questions
Do you support hardware keys or passkeys?
Not today. TOTP with recovery codes is what is available; WebAuthn is on the list.
Can I require two-factor for my whole organization?
Not as an enforced policy yet. Today it is per account, so ask your team to turn it on - and check.
Something here wrong, missing or out of date? Tell us and we will fix the page.