Skip to main content

Two-factor authentication

Two-factor authentication (2FA) adds a second sign-in step: after the password, the user enters a 6-digit code from an authenticator app on their phone (Google Authenticator, Authy, 1Password, Microsoft Authenticator — anything TOTP-compatible). A stolen password alone is no longer enough to open the account.

2FA is available on every plan, and it protects the account, not one workspace: a person with memberships in several companies enrolls once and the code step applies to all of their sign-ins.

Employees have their own step-by-step enrolment guide in the public User guide — point staff there rather than walking each person through it.

Enabling 2FA on your own account​

  1. Open the user menu (top-right) → My Account → Sign-in & Security.
  2. On the Two-Factor Authentication card, click Enable two-factor authentication.
  3. Scan the QR code with your authenticator app (or type the setup key manually), then enter the 6-digit code the app shows.
  4. Save the recovery codes. They are shown exactly once — copy or download them and store them somewhere safe (a password manager is ideal).

From then on, signing in asks for your password first, then a code from the app. Entering one of your recovery codes instead also works — each recovery code works once, and the card shows how many you have left. You can generate a fresh set at any time (the old set stops working immediately).

The name shown in your authenticator app

The entry is labelled with your workspace's configured app name (falling back to the platform's name) as it was at the moment you enrolled. Renaming the workspace or platform later doesn't relabel existing entries — only new enrollments pick up the new name.

If you lose your authenticator​

  • You still have recovery codes — sign in with one, then disable and re-enable 2FA from Sign-in & Security to enroll your new device.
  • You lost the codes too — ask a workspace administrator to reset your 2FA (below). You'll sign in with just your password and can re-enroll.

After 5 wrong codes, the 2FA step locks for 15 minutes. This counter is separate from the password lockout.

Requiring 2FA for the whole workspace​

Admins can make 2FA mandatory: Company → Settings → Security → Require two-factor authentication.

While the toggle is on:

  • Members who haven't enrolled are taken through 2FA setup at their next sign-in, before they reach the workspace.
  • Members cannot disable 2FA on their account while they belong to a mandating workspace (the disable button tells them which company requires it).
  • Switching into the workspace from another company (multi-company accounts) is blocked until the account enrolls — enrolling from any workspace satisfies the mandate, because 2FA is account-level.

Resetting a member's 2FA (admin)​

An administrator holding the Reset a Member's Two-Factor Authentication permission (users.manage_2fa — granted to Super Admin by default) can clear a member's enrollment from Access Control → Users (the shield-off action on the row, shown only for members with 2FA enabled).

The reset removes the authenticator and all recovery codes; the member signs in with just their password until they re-enroll. Because 2FA protects the whole account, the reset also removes the protection from the person's memberships in other workspaces — the action is confirmed, recorded in the login audit trail, and the member is notified by email.

caution

Treat this permission like impersonation: it is an account-takeover primitive in the wrong hands. Grant it sparingly.

Good to know​

  • Sessions opened via admin impersonation deliberately do not prompt for the target's 2FA — impersonation has its own permission and audit trail.
  • Every 2FA event (challenge, success, failure, enable, disable, reset) appears in the login audit trail with the acting IP and device.
  • Security emails are sent when 2FA is enabled, disabled, or reset on an account.