Two-factor authentication (2FA, also called MFA) protects your account with a second step: after your password, you type a 6-digit code from an app on your phone. Someone who learns your password still cannot get in.
Who can do this
Every panel account. Open Account → Security. If your organization requires 2FA, you will see a Two-factor authentication required banner there and cannot open organization data until you finish.
Set up 2FA
- 1Install an authenticator app on your phone, for example Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden or Authy.
- 2Open Account → Security and click Enable two-factor authentication.
- 3Scan the QR code with the app. If you cannot scan it, type the Manual entry key into the app instead.
- 4Enter the 6-digit code the app shows and click Verify and enable.
- 5Save your recovery codes: copy them (Copy all) or Print them, tick I've saved my recovery codes in a safe place. and click Finish setup.
After setup the card shows Enabled, the date and how many recovery codes you have left.
Recovery codes
You get 10 recovery codes. Each one works once and lets you log in when you do not have your phone.
You see the codes only once
Keep them in a password manager or print them and store them safely. If you use them up or lose them, click Regenerate recovery codes, confirm with a current code from the app and save the new set — the old codes stop working immediately.
Logging in with 2FA
- 1Enter your email and password as usual.
- 2Type the 6-digit code from your app.
- 3No phone at hand? Click Use a recovery code instead and enter one of your recovery codes.
The same applies when you log in with an email link or after a password reset — neither skips the code.
Turn 2FA off
On the same page click Disable, type a current code from the app and confirm with Disable 2FA. If your organization requires 2FA, you lose access to its data until you turn it back on.
FAQ
I have a new phone. What do I do?
While you still have the old phone, turn 2FA off and set it up again on the new one. If the old phone is gone, log in with a recovery code and do the same.
I lost my phone and my recovery codes.
Write to [email protected] from the email address of your account. Your organization's Admin cannot turn off 2FA for you.
The code is always "wrong".
Check that the time on your phone is set automatically. Authenticator codes depend on the exact time and change every 30 seconds.