> ## Documentation Index
> Fetch the complete documentation index at: https://docs.brosbots.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-step sign-in

> A code from an authenticator app as well as the password, for the panel's API too.

## Turning it on

1. Account menu → **Security**, the **Two-step sign-in** card.
2. Click **Turn on**.
3. Scan the QR code with an authenticator app (Google Authenticator,
   Microsoft Authenticator, 1Password, Authy). With no camera, enter the key
   shown under the code in the app.
4. Enter the 6-digit code from the app and click **Confirm**.

From then on, after the password (or after Google sign-in) the panel asks for
a code from the app. Every team member turns it on for themselves, including
somebody with the **Viewer** role.

## What it protects

Somebody who learns your password cannot sign in without the phone with the
app. A session from the password alone does not work with the panel's API
either: the server refuses it with `401 mfa_required`, so the code cannot be
skipped by calling the API directly.

[API keys](https://docs.brosbots.com/en/voice-agent/api-trigger.md) work without a code, since they are a
separate credential. Keep them secret and revoke the ones you do not use.

## Turning it off

**Security** → **Turn off** and confirm. Turning it off needs a session that
passed the code, so a password alone cannot remove it.

## Lost phone

If you no longer have the app, click **Contact support** on the code screen.
Once we have confirmed the account is yours, we remove the app from it and
you sign in with the password alone again.

Changes to two-step sign-in show in the [Audit log](https://docs.brosbots.com/en/features/audit-log.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.