Skip to main content

​
Turning it on

  1. Account menu → Security, the Two-step sign-in card.
  2. Click Turn on.
  3. Scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy). With no camera, enter the key shown under the code in the app.
  4. Enter the 6-digit code from the app and click Confirm.
From then on, after the password (or after Google sign-in) the panel asks for a code from the app. Every team member turns it on for themselves, including somebody with the Viewer role.

​
What it protects

Somebody who learns your password cannot sign in without the phone with the app. A session from the password alone does not work with the panel’s API either: the server refuses it with 401 mfa_required, so the code cannot be skipped by calling the API directly. API keys work without a code, since they are a separate credential. Keep them secret and revoke the ones you do not use.

​
Turning it off

Security → Turn off and confirm. Turning it off needs a session that passed the code, so a password alone cannot remove it.

​
Lost phone

If you no longer have the app, click Contact support on the code screen. Once we have confirmed the account is yours, we remove the app from it and you sign in with the password alone again. Changes to two-step sign-in show in the Audit log.