# Two-factor sign-in

> Protect your account with an authenticator app, and require it for everyone in a workspace.

Accounts sign in with **Google** or a **one-time code by email**. Add an authenticator app for a second step at every sign-in.

## Turn it on

1. On your **Account** page, add an authenticator.
2. Scan the QR code with an app like 1Password, Google Authenticator or Authy. (Or choose **Can't scan? Use a key** and type it in.)
3. Enter the **Code from the app** and click **Turn on**.

From then on, after Google or the email code, you're asked for the 6-digit code from the app.

## Add a backup

There are no recovery codes. **Add a second authenticator** (another phone, or a password manager) on your Account page, so losing one device doesn't lock you out. If you lose every authenticator, contact support from the email on your account.

You can remove an authenticator only from a session that passed two-factor, and not your last one while a workspace you're in requires it.

## Require it for a workspace

In **Settings → Sign-in**, owners and admins can turn on **Require two-factor authentication**. You need two-factor on your own account first. The setting shows how many members already use it, and asks you to confirm if some don't.

When it's on, members without two-factor can't open the workspace until they set it up; they're taken to setup when they try. It's enforced by the database as well as the dashboard, so it can't be bypassed through another route.

## Sessions

On your **Account** page, sign out of **Other devices** (every browser except this one) or **Everywhere**.

Two-factor changes are recorded in the [audit log](/manage/logs#audit-log).