Account security

Everything here is at Security, and is available to every user regardless of workspace role — these are personal account settings, not workspace ones.

Multi-factor authentication

MFA adds a second factor at sign-in. We support two, and you can use both.

Authenticator app (TOTP)

The standard six-digit rotating code, compatible with any authenticator app.

1. Choose to enable authenticator-app MFA.
2. Scan the QR code, or enter the setup key manually.
3. Enter a code from the app to confirm.
4. Save the recovery codes you are shown.

Each code can be used once — a code you have already used will not be accepted a second time, even within its validity window.

Passkeys

A passkey authenticates with your device’s biometric or PIN — Touch ID, Face ID, Windows Hello, or a hardware security key. There is nothing to type and nothing phishable.

Register one from the Security page and name it after the device, so a list of several remains meaningful. Register a passkey on more than one device, or keep recovery codes, so losing a single device doesn’t lock you out.

Recovery codes

When you enable MFA you are given 10 single-use recovery codes. They are your way back in if you lose your authenticator or passkey device.

Recovery codes are shown once

They cannot be displayed again. Store them in a password manager or somewhere genuinely safe — not in the same place as your password, and not only on the device holding your authenticator.

You can regenerate them at any time, which invalidates all previous codes — so if you regenerate, discard the old list.

The Security page shows how many remain unused. If that number is getting low, regenerate.

Active sessions

The Security page lists your active sessions with device, approximate location and last-seen time. You can:

• Sign out an individual session, or
• Sign out everywhere else, keeping only your current session.

Review this if you have signed in on a shared or public machine, or if anything looks unfamiliar. Signing out other sessions is instant and a reasonable first response to any suspicion — it costs you nothing but a re-login.

Recommended setup

1. Enable a passkey on your primary device — the least friction and the strongest protection.
2. Add authenticator-app MFA as a portable fallback.
3. Store the recovery codes in your password manager.
4. Register a passkey on a second device.

What is not available yet

So you can plan accurately:

• No “remember this device” — MFA is requested on each new sign-in.
• No passwordless sign-in. A passkey is a second factor, not yet a replacement for your password.
• No organisation-wide MFA enforcement. Enrolment is per user and cannot yet be mandated for a workspace. If you need everyone covered, that is currently a policy you enforce yourselves.
• No SSO or SCIM for customer accounts.

API keys are separate

MFA protects your account — signing into the app. It does not gate API keys, which authenticate machine traffic and carry no second factor by design. A leaked key is usable regardless of your MFA status, so treat keys with the same care as passwords: scope them, set expiry, restrict by IP where you can, and revoke immediately if exposed. See Authentication.