Enable 2-factor auth

A password alone is one breach away from account takeover. Two-factor authentication adds a second factor – something you have – so a leaked password isn't enough on its own. Everyone with workspace owner or admin permissions should have 2FA enabled.

Enable TOTP (recommended)

1. Go to Settings → Profile → Security.
2. Click Enable 2-factor authentication.
3. A QR code appears. Scan it with Authy, 1Password, Google Authenticator, or any TOTP-compatible app.
4. Enter the 6-digit code your app displays to confirm.
5. Save your 10 backup codes somewhere safe (1Password, password manager). You'll need one if you ever lose access to your TOTP device.
6. Done. Next time you sign in, you'll be asked for the code after your password.

Hardware security key (WebAuthn)

YubiKeys and other FIDO2 keys are stronger than TOTP and faster to use. After enabling TOTP, click Add hardware key in the same Security panel and follow the prompts to register a key. You can register multiple keys (recommended: one primary, one backup).

Sign-in flow with 2FA

After you enter your password, we ask for your second factor. WebAuthn keys present a browser prompt to tap the key. TOTP apps show a 6-digit code that rotates every 30 seconds. Pick whichever method you have handy – they're interchangeable.

Using backup codes

If you lose your TOTP device and your hardware keys, the 10 backup codes are your way back in. Each is single-use. After you use one, only 9 remain. Generate fresh codes from the same Security panel – old codes are invalidated.

Disable 2FA

Settings → Profile → Security → Disable 2FA. We require you to enter your password first. Disabling removes all TOTP devices and hardware keys – backup codes are invalidated. You can re-enable later, but you'll generate fresh secrets and codes.

Workspace enforcement (CEO plan)

Workspace owners on the CEO plan can require 2FA for all members. When enabled, members without 2FA are forced to set it up on next login. Find it under Settings → Team → Security.

Common questions

What if I lose everything – TOTP, keys, backup codes?

Contact [email protected] from the email on the account. We verify identity (likely a short video call), then reset 2FA after a 48-hour cooldown. The cooldown protects against social-engineering attacks.

Does Google sign-in skip 2FA?

If you sign in with Google, we trust the 2FA you have configured on Google itself. We don't re-prompt. Enable 2FA on your Google account if you sign in that way.