Securing your account

Two-factor authentication (MFA) adds a second layer of security on top of your password. Even if your password is compromised, an attacker cannot sign in without your second factor.

Setting up MFA

Open the menu in the lower-left corner of the app, then go to User settings > Security.

Under Multi-factor authentication, click Set up MFA. You will be asked to choose a method.

Authenticator app (recommended)

An authenticator app generates a 6-digit code on your phone that refreshes every 30 seconds. It works without a mobile signal and is more secure than SMS.

Popular apps: Google Authenticator, Authy, 1Password, Microsoft Authenticator.

1. Click Authenticator app

2. Scan the QR code with your app — or tap Can't scan it? Enter the setup key to enter it manually

3. Enter the 6-digit code shown in your app to confirm

4. Save your recovery codes somewhere safe (see below)

Passkey

A passkey uses your device's biometrics (Face ID, Touch ID) or a hardware security key to confirm your identity, no code to type. You can use it as a second factor after your password, or to sign in without a password at all.

See Sign in with a passkey for setup instructions and full details.

SMS

A 6-digit code is sent to your phone by text message each time you sign in.

1. Click Other method → SMS authentication

2. Enter your phone number

3. Enter the 6-digit code received by SMS to confirm

This phone number is tied to your MFA method and stays the same even if you update your profile phone number.

Recovery codes

When you set up an authenticator app, you receive 10 one-time recovery codes. Each code can be used once to sign in if you no longer have access to your authenticator app. They are only shown once — save them somewhere safe or download them as a file.

If you use a recovery code to sign in, re-enrol a new authenticator app right afterwards.

Managing your methods

From User settings > Security, you can:

• See all active MFA methods and when they were added

• Remove a method (requires confirming your password)

If your administrator has required MFA on your account, you cannot remove your last active method.

Signing in with MFA

After entering your email and password, you are prompted for your second factor:

• Authenticator app — enter the 6-digit code shown in your app

• Passkey — confirm with Face ID, Touch ID, or your hardware key

• SMS — enter the 6-digit code sent to your phone

• If you have multiple methods, click Choose another method to switch between them

• If you no longer have access to any method, click No longer have access? to enter a recovery code