What it is
Two-factor authentication is a second question at the door. You already know the first one: your password. The second is a verification code: six digits shown by an app on your phone, changing every thirty seconds.
The point is simple: a password can be learned. It can leak with somebody else's database, it can be read over your shoulder, it can be talked out of you by a convincing email. A verification code cannot be learned that way: it lives for thirty seconds and exists only on your phone. Without a second factor, a stolen password is a stolen account; with one, it is not.
The second factor belongs to your account, not to a company. Switch it on once and it works in every company you belong to. One authenticator app covers all of them.
No outside service is involved. Codes are computed from an open standard, RFC 6238, on your phone and on our servers independently; nothing travels between the two. We do not use SMS, because phone numbers get hijacked more often than passwords do.
Switching it on
You will need an authenticator app on your phone. Any of them will do: Google Authenticator, Microsoft Authenticator, Aegis, 1Password, Bitwarden. They all follow the same standard.
- Open Profile, find the Two-factor authentication card and press Set up.
- Scan the QR code with the app. If the camera is unavailable, the same key is printed underneath as text and can be typed into the app by hand.
- The app starts showing six digits. Type them in and press Turn on.
Until you have entered a correct code, the second factor is not on. That is deliberate: switching on a factor nobody has tested is a reliable way to lock somebody out of their own account. If you closed the screen halfway, start again. A key you never confirmed lives for a day and then disappears on its own.
The moment it is on, the product shows your backup codes. Do not leave that screen without saving them.
Backup codes
Backup codes are ten one-time codes for the times when there is no way to reach the app: the phone is flat, lost, at home, or broken.
Each one works once. You can type it on the same screen that asks for a verification code, in place of the six digits.
Three things are worth knowing about them:
- They are shown once. We keep only their hashes, exactly as we keep passwords, so showing them again is impossible, for you and for us. Copy them or download the file, and put them wherever your other important things live: a password manager, a safe, a sheet of paper in a drawer.
- Generating new ones replaces the whole set. All ten of the old ones stop working, including the ones you never used. Eight old plus ten new is not a set of ten, it is a muddle.
- When three or fewer are left, the product says so on the screen and emails you. Generate a new set while you still have one to do it with.
If you lose something
If you still have the phone, sign in and generate new backup codes.
If you still have a backup code, sign in with it, switch the second factor off, and switch it on again on the new phone. Turning it off and generating new codes both accept a backup code exactly as they accept one from the app: this is the situation backup codes exist for.
If you have neither the phone nor the codes, write to support from the email address the account is registered to.
There is no self-service way to reset the factor. But since 6 September 2026 an administrator of your company can reset it for you, if your account belongs to that company and no other. They cannot reset their own, you get an email within the minute, every session of yours ends, and the company's audit trail names who did it.
If your account belongs to several companies, the reset still comes from support only: one company's administrator must not weaken your access to another, whose administrators would never hear about it.
There is no reset by a link in an email, and there will not be:
- A reset by email link will not be added: the second factor would then be the email address, and the password reset already goes through it. Two factors that are both the same address are one factor with extra steps.
- The administrator's reset is bounded on purpose: only for an account in one company, never their own, and always loud: an email to you and a line in the company's trail. That is detection, not prevention, and that is the price of the decision.
The door does not open by itself and does not open by email. A person opens it, and that person answers for it.
Passwords and other sessions
Changing your password does not touch the second factor: they are different secrets, and somebody who changed one has not proved the other.
Switching the second factor off ends every other session of the account, and the one you switched it off from stays open. People usually switch it off because something went wrong, and at that moment it is useful that anybody holding a session of yours elsewhere loses it.
A company's requirement
A company can make a second factor mandatory for all of its users. The setting is in Administration → Security and is off by default.
How it works:
- The requirement is checked when you enter the company, not when you sign in to your account. Your account opens as usual; the company is what stays shut.
- Without a factor, the company shows a screen saying it requires one, with the way to set it up on the same page.
- The company opens the moment the factor is on, with no need to sign in again.
- The requirement does not reach the other companies you belong to: the factor belongs to your account, the requirement to that company.
When an administrator switches the requirement on, the product tells them how many people are without a second factor right now and therefore will not be able to enter. Each of those people gets one email saying the rule has changed.
The requirement applies to everybody in the company at once. There is no "administrators only" setting: the account of somebody who matters less opens exactly the same company.
What it does not cover
- Signing in as another person. Whoever does it passed their own second factor to get there; the other person's factor is not asked for. Otherwise the product itself would be teaching people to read verification codes down the phone, which is the very scam the second factor exists to defeat.
- Service accounts, API tokens and MCP. They authenticate with a secret that is already single-purpose, revocable and scoped. A person's phone has nothing to do with a robot's credentials.