Two-factor authentication

Turn it on

1. Go to Settings › Security.
2. Under Two-factor methods, click Add method.
3. Enter your password to confirm it is you. If you sign in with Google only, this step is skipped.
4. Choose Set up authenticator app. Google Authenticator, Microsoft Authenticator, 1Password and other authenticator apps work.
5. Scan the QR code with the app. If you cannot scan it, enter the key shown under Can't scan? Enter this key instead.
6. Enter the 6-digit code from the app and click Continue.
7. Save your recovery codes (see below), tick I saved my recovery codes somewhere safe and click Done.

The page then shows Authenticator app with the date you added it.

If you sign in with Google or SSO, the page says those handle two-factor for you.

Recovery codes

You get 10 recovery codes when you set up. Use them if you lose your phone. Each works once, and they are shown only at setup, so copy or download them and store them safely.

Settings › Security shows how many are left, for example 7 of 10 left. Click Get new codes, enter a code from your app, and you get a fresh set. The old codes stop working.

Sign in with it

1. Enter your email and password as usual.
2. On the Two-factor sign-in step, enter the 6-digit code from your authenticator app.
3. If you lost your phone, click Use a recovery code and enter one of your codes instead.

A code cannot be used twice. After 5 wrong codes, two-factor sign-in is locked for 15 minutes.

Turn it off

1. Go to Settings › Security.
2. Click Remove next to Authenticator app.
3. Enter a code from your app (or a recovery code) and click Turn off.

If your company requires two-factor, the page shows Required by your company and you cannot remove it while you sign in with a password.

Require it for your team

Admins with permission to manage the team see Require two-factor for everyone at the top of Settings › Security. It shows how many people have two-factor on, for example 3 of 5 people have it on.

1. Turn it on for yourself first. The button is disabled until you do.
2. Click Set up, then confirm.

Everyone who signs in with a password and has no two-factor yet is signed out and asked to set it up on their next sign-in. The setup cannot be skipped. People who sign in with Google or SSO are not affected. To stop requiring it, click Turn off and confirm.

When someone loses their phone and recovery codes

On Settings › Team, open the menu for the person and choose Reset two-factor (you need permission to manage the team). Their authenticator and recovery codes stop working and they are signed out. They sign in with their password and set up two-factor again. Only the account owner's reset needs billing access. People with two-factor on show a 2FA tag in the team list.