Turn on two-step sign-in

Turn it on

1. Open Account and find Two-step sign-in.
2. Choose Turn on, then pick a passkey or a code from an authenticator app.
3. For an app, scan the QR code with an app such as Google Authenticator or 1Password, then type the 6-digit code it shows.
4. Save your 10 recovery codes somewhere safe, like your password manager, then choose Finish.
5. Leave Sign out everywhere else ticked, so your other devices, the extension and connected AI apps sign in again with the second step. AI tool tokens you made, in every workspace, stop working too and must be made again in Settings; tokens a teammate made keep working.

What we ask for when you sign in

• A passkey. Touch ID, Face ID, Windows Hello or a security key. It only works on SiteViewer, so a fake sign-in page gets nothing.
• A code from your app. Six digits that change every 30 seconds.
• A recovery code. If you don't have your phone or passkey. Each code works once.

Signing in with a passkey already counts as both steps, so we never ask twice. We don't send codes by text message: a phone number can be moved to someone else's phone without you knowing.

If someone keeps trying wrong codes when signing in, we stop accepting that kind of code for a while and email you. Codes from your app and recovery codes are counted separately, and your passkey always works. If this wasn't you and you have a password, remove it and choose Sign out other devices in Account; neither needs a code. Without a password, Sign out other devices is enough: anyone else would then need your email to get back in. The browser extension (Connected browsers) and AI tool connections are managed separately in Account.

Don't ask again on this computer

When you type a code from your app, you can tick Don't ask again on this computer for 30 days. Turning two-step sign-in off, making new recovery codes or changing your password asks every computer again. Anyone who can open client information that needs two-step sign-in is asked every time.

Confirm it's you

Some changes need a quick check even when you're signed in: changing your sign-in email or password, adding someone to your team, connecting the extension, an AI app, Slack or Google Calendar, making an AI tool token, adding or removing a passkey, setting up a webhook, downloading reports or everything in your workspace, closing your account, making new recovery codes, turning two-step sign-in off, and the team settings below. Use your passkey, a code from your app or a recovery code. Without two-step sign-in, we email you a 6-digit code instead. We won't ask again for the next 10 minutes. After five wrong codes here, whether from your app, a recovery code or an emailed code, we sign that browser out for your security and email you. After too many wrong codes of one kind in a day, we stop accepting that kind here until the next day; the other kind, and your passkey if you have one, still work. Removing your password and Sign out other devices never need this check. Removing your password means nobody can sign in with it; Sign out other devices signs every other browser out. The browser extension (Connected browsers) and AI tool connections are managed separately in Account. You can set a new password after 24 hours.

For workspace owners

• Require it for the team. In Team, turn on Require two-step sign-in for everyone on the team. Anyone without it gets an email and 7 days to set it up. After that, they're asked to set it up the next time they open your workspace, and can't carry on in it until they do. Their own workspaces elsewhere aren't affected, and they can always leave yours.
• See who has it. Each person in Team shows whether two-step sign-in is on, with Send a reminder for anyone who hasn't set it up.
• Reset a teammate. If a teammate loses their phone and codes, open the menu on their row in Team and choose Reset two-step sign-in. Only do this once you're sure it's them asking. Their app and recovery codes stop working, and their passkeys keep working. We email them either way. If they're also on another workspace, support resets it instead.