Two-factor sign-in
Two-factor authentication adds a second proof to your account: a six-digit code from an authenticator app. It uses Time-based One-Time Passwords (TOTP), so any standard app works. Examples are Aegis, 1Password, and Google Authenticator.
The platform doesn't ask for the code when you sign in. You can read with your password alone. The platform asks for the code the first time in a session that you change something or open the admin tools. After you answer, the platform stays quiet for a while and then asks again. The default window is 30 minutes.
Turning it on for yourself
- Open Security & Access in the sidebar. The Two-factor authentication section shows Off.
- Select Turn on two-factor authentication.
- Scan the QR code with your authenticator app. If you can't scan it, enter the setup key under Can't scan it? by hand.
- Enter the six-digit code the app shows, and select Turn on two-factor authentication.
A wrong code shows an error, and you stay on the same page. The QR code doesn't change if you reload, so the entry in your app stays valid.
When the code is right, the platform turns two-factor on and shows your recovery codes once.
When the platform asks for a code
The prompt is a Verify it's you window over the page you are on. Enter the six-digit code from your app, or one of your recovery codes. When the code is right, the platform repeats the action you started. You don't need to do it again.
If your browser blocks scripts, the platform shows a full page with the same form. A right code sends you back to where you were.
| Action | Code needed |
|---|---|
| Reading any page | No |
| Saving a form, deleting something, minting a token | Yes, once for each window |
Opening a page under /admin |
Yes, once for each window |
Using an API token with sc or a Model Context Protocol (MCP) client |
No. A token is the credential, so there is no session to confirm |
Recovery codes
At setup the platform gives you ten recovery codes. Each one signs you through the second factor once. Use one on the day your authenticator app isn't to hand.
- The platform shows the codes once. Save them somewhere safe.
- A code works in any place that accepts a six-digit code.
- The Recovery codes section shows how many codes you have left.
- Regenerate recovery codes replaces every code. The old codes stop working at once. Do this if you run low or think a code has leaked.
Turning it off
Select Turn off two-factor authentication in the Turn off section. The platform removes the second factor and all recovery codes. Your account goes back to password only.
You can't turn it off while an organization you belong to requires it. The button is missing, and a notice says why.
When an organization requires it
An owner or admin can require two-factor for every member of an organization. See Security policy. If you haven't set it up yet, the first change you try sends you to a Your organization requires this page. You can't skip it. When you finish, the platform takes you back to what you were doing.