Protect your account

Sign in, open your username menu, and choose Profile & security. Under Multi-factor authentication, choose a method:

Method	What you need
Passkeys	A browser and device or passkey provider that supports passkeys. Follow its fingerprint, face, or device PIN prompt; compatible security keys can also work.
Authenticator app	An app that generates time-based six-digit codes, such as Google Authenticator, Microsoft Authenticator, or 1Password.

Multi-factor authentication (MFA), also called two-factor authentication (2FA), is optional and belongs to your account across workspaces. You do not need an administrator role. You can use either method or both. Passkeys provide the second verification step; you still start with your password or Google sign-in.

If MFA is already on, adding or changing a method requires verification with an existing method or an unused recovery code.

1. Under Passkeys, choose Add passkey.
2. If asked, verify with an existing method.
3. Enter a Passkey name you will recognize, then choose Create passkey.
4. Complete your browser or device prompt. A security key must support passkeys and PIN or biometric verification.
5. For your first method, save your recovery codes and finish setup.

Check that your named passkey appears and MFA shows On. You can register up to ten passkeys. Adding another method keeps your existing recovery codes.

1. Under Authenticator app, choose Set up app.
2. Choose Continue, or verify with an existing method if MFA is already on.
3. In your authenticator, add an account and scan the QR code. If scanning is unavailable, choose Can’t scan? Enter a setup key in Zentrik and enter that key as a time-based account in your app.
4. Enter the Six-digit code from your app and choose Verify code.
5. For your first method, save your recovery codes and finish setup.

Check that the authenticator shows Active and MFA shows On. Keep the QR code and setup key private.

Your first method includes ten recovery codes, shown only once. Setup is not complete until you save them and confirm.

1. Choose Download codes, or copy them into secure storage you can access if you lose your authentication devices.
2. Select I saved my recovery codes somewhere safe.
3. Choose Finish setup.

Each code works once. Keep the codes private and separate from your authentication devices. Canceling setup leaves your account’s active methods unchanged.

Under Account recovery, you can see how many unused codes remain. Choose Generate new codes, verify your identity, and save and confirm the replacement set. Finishing invalidates the old codes and signs out other sessions.

Sign in with your password or Google account, then complete Verify your sign-in with a passkey or authenticator code. Choose Try another way to switch methods.

If you cannot use any enrolled method:

1. Choose Try another way → Use a recovery code.
2. Enter an unused recovery code and choose Verify.
3. Choose Set up a new passkey or Set up a new authenticator.
4. Complete setup and save the new recovery codes within five minutes.

Recovery signs out all sessions. You can enter the app only after finishing the replacement setup, which removes all previous verification methods and replaces the recovery codes. If recovery expires or you cancel passkey recovery, start sign-in again with another unused code.

If you have lost every method and all recovery codes, ask an eligible workspace Owner or Admin in a shared workspace for an account-security reset. They must verify your identity through a trusted channel first. A reset removes MFA across your account and signs you out everywhere. Follow the email instructions to sign in and set up protection again. If no eligible administrator is available, contact support.

Resetting your password preserves MFA; it does not replace a lost verification method.

Return to Profile & security to make changes:

• Replace app connects a new authenticator after verification. The old app stays active until you finish; your recovery codes stay valid.
• Remove beside a passkey or Remove app removes that method after verification and confirmation. Removing your last method turns MFA off and invalidates recovery codes.
• Active sessions → Sign out other sessions keeps this browser signed in and requires other browsers to sign in again.

Adding, replacing, or removing methods also signs out other sessions. These controls govern browser access. API keys and authorized integrations have separate access and revocation controls; see Workspace administration.