> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/onboarding/account/mfa.md).

# Securing your account

Two-factor authentication (MFA) adds a second layer of security on top of your password. Even if your password is compromised, an attacker cannot sign in without your second factor.

## Setting up MFA

Open the menu in the lower-left corner of the app, then go to `User settings` > `Security`.

Under **Multi-factor authentication**, click **Set up MFA**. You will be asked to choose a method.

### Authenticator app (recommended)

An authenticator app generates a 6-digit code on your phone that refreshes every 30 seconds. It works without a mobile signal and is more secure than SMS.

Popular apps: Google Authenticator, Authy, 1Password, Microsoft Authenticator.

1. Click **Authenticator app**
2. Scan the QR code with your app, or tap **Can't scan it? Enter the setup key** to enter it manually
3. Enter the 6-digit code shown in your app to confirm
4. Save your recovery codes somewhere safe (see below)

### Passkey

A passkey uses your device's biometrics (Face ID, Touch ID) or a hardware security key to confirm your identity, no code to type. You can use it as a second factor after your password, or to sign in without a password at all.

See [Sign in with a passkey](/onboarding/account/passkey.md) for setup instructions and full details.

### SMS

A 6-digit code is sent to your phone by text message each time you sign in.

1. Click **Other method → SMS authentication**
2. Enter your phone number
3. Enter the 6-digit code received by SMS to confirm

{% hint style="info" %}
This phone number is tied to your MFA method and stays the same even if you update your profile phone number.
{% endhint %}

## Recovery codes

When you set up an authenticator app, you receive **10 one-time recovery codes**. Each code can be used once to sign in if you no longer have access to your authenticator app. They are only shown once. Save them somewhere safe or download them as a file.

If you use a recovery code to sign in, re-enrol a new authenticator app right afterwards.

## Managing your methods

From `User settings` > `Security`, you can:

* See all active MFA methods and when they were added
* Remove a method (requires confirming your password)

{% hint style="info" %}
If your administrator has required MFA on your account, you cannot remove your last active method.
{% endhint %}

## Signing in with MFA

After entering your email and password, you are prompted for your second factor:

* **Authenticator app**: enter the 6-digit code shown in your app
* **Passkey**: confirm with Face ID, Touch ID, or your hardware key
* **SMS**: enter the 6-digit code sent to your phone
* If you have multiple methods, click **Choose another method** to switch between them
* If you no longer have access to any method, click **No longer have access?** to enter a recovery code


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/onboarding/account/mfa.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.