Two-factor authentication and passkeys

Add a second factor from your Profile and a stolen password stops being enough to reach your account.

Authenticator app (TOTP)#

1. Choose Enable two-factor and scan the QR code with any authenticator app (Google Authenticator, 1Password, Authy…).
2. Confirm a 6-digit code to finish enrollment.
3. Store your recovery codes somewhere safe — they are shown once, and they are your way in if you lose the phone. You can regenerate a fresh set any time (which invalidates the old set).

Passkeys#

• Register your device's Face ID, fingerprint, or security key for phishing-resistant sign-in — nothing to type, nothing to intercept.
• Passkeys are per portal domain; if you sign in at more than one address, register on each.
• Remove a passkey whenever a device is retired or lost.

If you are locked out#

Use a recovery code at the 2FA prompt. Out of codes too? An account manager can support-reset your factors so you can re-enroll — see Requiring two-factor for your team.