Two-factor authentication

Turning it on

Under Security, scan the code shown with your authenticator app, or type the key by hand if you have no camera. Your password is asked for to begin.

Turning your second factor on or off closes all your sessions, on every device. It is the same mechanism as a password change. You have to sign in again, and that is intended.

Backup codes

10 codes, shown only once, when you turn it on. Download them or write them down right then: the database only keeps their fingerprint, and nobody (not even us) can give them back.

Each code works once. The Security screen shows how many are left.

Lost the sheet, nearly out of codes, or someone else saw them? Under Security, “Generate new backup codes” issues 10 new ones, shown only once as well. The old ones stop working at once, including those you had not used. Nobody is signed out.

It takes the six-digit code from your app, not a backup code. Backup codes are the very thing this protects: if holding one were enough to cancel the others, a sheet glimpsed on a desk would be worth your account.

If you lose all of them along with your phone: an admin in your organization can remove your second factor. They cannot do it for themselves, and the person concerned is told by email.

Changing your password

Under Security, in “Password”. Your current password is asked for, and a code if two-factor authentication is on: the one from your app, or a backup code. The new password follows the same rule as at sign-up, twelve characters at least.

Changing your password closes all your sessions, on every device, including the one you change it from. You sign in again with the new one. API keys keep working: a key is revoked from the keys screen.

An account created with “Continue with Google” has no password, and the screen says so. To set one, use “Forgot your password?”: the link sent by email proves the address is yours, and the Google button keeps working.

Requiring it across a team

An admin can make the second factor mandatory for the organization. The screen then shows how many members have not turned it on yet.

• Nobody is thrown out: open sessions stay open, and nobody loses a draft in progress. The member concerned is taken to the Security screen on their next action.
• Invitations always go through. You cannot turn on a second factor for an account you do not have yet.
• API keys and the MCP server are not concerned. There is nobody in front of a key: asking it for six digits from a phone would cut your scheduler off within the second. The list of keys still valid is shown next to the setting, for exactly that reason.
• Signing in with a Google account is still a first factor, not an exemption: nothing tells us whether that account has its own two-step verification.