Last updated October 1, 2026
On this page
Your Account Security
Three controls protect your account: a second step at sign-in, a reset for a lost authenticator, and password recovery.
These controls cover you as a person signing in. Your plugins and agents use separate credentials with their own lifecycle; see Signing In & Credentials.
Turn on two-factor authentication
Two-factor authentication adds a second step after your password: a six-digit code from an authenticator app on your phone. With it on, a stolen password alone can't sign anyone in.
Open Profile and go to Two-factor authentication. Choose Set up authenticator app, scan the QR code with your app, and enter the code it shows to confirm the pairing.
Any standard TOTP app works, including Google Authenticator, 1Password, and Authy. We don't offer SMS as a second factor.
Setting up an authenticator turns two-factor on for your account. There's no separate "enforce" step.
Once it's on, you enter a code each time you sign in. You can turn it off from the same place. We email you whenever the setting changes.
If you sign in with Google or enterprise SSO
If you sign in through Google or your company's identity provider, Profile doesn't show the two-factor controls. That provider authenticates you and we never see a password, so configure your second factor in the identity provider.
If you lose your authenticator
An organization admin can reset your second factor if you lose or wipe your phone. Without the reset you'd be locked out, since turning off two-factor yourself needs the app.
On the Team page, the admin opens the menu next to your name and chooses Reset 2FA. The reset clears the registered device. You can then sign in with your password alone and set up a new authenticator.
If you're the only admin, add a second one before you turn two-factor on. Otherwise, if you lose your phone, nobody can reset it for you.
Passwords and recovery
Change your password from Profile, under Password. As with two-factor, we email you when it changes.
If you've forgotten it, use Forgot password on the sign-in page. Recovery runs entirely through your registered email address. There's no SMS route, so taking over your phone number doesn't give anyone your account.
Requiring it across your organization
The portal has no organization-wide MFA switch; each person enrolls on their own.
To require MFA for your whole team, enforce it in your identity provider and require SSO for your domain. Every member then authenticates through a provider you control, under the policy you set there. Enterprise SSO walks through verifying a domain and turning on required SSO.
Once you require SSO for a verified domain, password and Google sign-up for that domain are refused at the identity layer. Before you turn it on, check that everyone who needs to sign in can reach your provider.
What's next
Enterprise SSO
Verify a domain, register your identity provider, and require SSO for everyone on it.
Permissions & Access Control
Who can reset a member's second factor, and what else an admin can do.
Signing In & Credentials
The separate credentials your plugins and agents use.
Organization Settings
Members, roles, and the rest of what an admin manages.