--- title: "Protect your account" canonical_url: https://zentrik.ai/docs/product/account-security markdown_url: https://zentrik.ai/docs/product/account-security.md category: "Product guides" learning_track: "administration" last_reviewed: 2026-11-06 --- # Protect your account Add a passkey or authenticator app to verify your identity after password or Google sign-in. Save recovery codes so you can regain access if you lose your verification methods. ## Overview Sign in, open your username menu, and choose **Profile & security**. Under **Multi-factor authentication**, choose a method: | Method | What you need | | --- | --- | | **Passkeys** | A browser and device or passkey provider that supports passkeys. Follow its fingerprint, face, or device PIN prompt; compatible security keys can also work. | | **Authenticator app** | An app that generates time-based six-digit codes, such as Google Authenticator, Microsoft Authenticator, or 1Password. | Multi-factor authentication (MFA), also called two-factor authentication (2FA), is optional and belongs to your account across workspaces. You do not need an administrator role. You can use either method or both. Passkeys provide the second verification step; you still start with your password or Google sign-in. If MFA is already on, adding or changing a method requires verification with an existing method or an unused recovery code. ## Add a passkey 1. Under **Passkeys**, choose **Add passkey**. 2. If asked, verify with an existing method. 3. Enter a **Passkey name** you will recognize, then choose **Create passkey**. 4. Complete your browser or device prompt. A security key must support passkeys and PIN or biometric verification. 5. For your first method, [save your recovery codes](https://zentrik.ai/docs/product/account-security#recovery-codes) and finish setup. Check that your named passkey appears and MFA shows **On**. You can register up to ten passkeys. Adding another method keeps your existing recovery codes. ## Set up an authenticator app 1. Under **Authenticator app**, choose **Set up app**. 2. Choose **Continue**, or verify with an existing method if MFA is already on. 3. In your authenticator, add an account and scan the QR code. If scanning is unavailable, choose **Can’t scan? Enter a setup key** in Zentrik and enter that key as a time-based account in your app. 4. Enter the **Six-digit code from your app** and choose **Verify code**. 5. For your first method, [save your recovery codes](https://zentrik.ai/docs/product/account-security#recovery-codes) and finish setup. Check that the authenticator shows **Active** and MFA shows **On**. Keep the QR code and setup key private. ## Save your recovery codes Your first method includes ten recovery codes, shown only once. Setup is not complete until you save them and confirm. 1. Choose **Download codes**, or copy them into secure storage you can access if you lose your authentication devices. 2. Select **I saved my recovery codes somewhere safe.** 3. Choose **Finish setup**. Each code works once. Keep the codes private and separate from your authentication devices. Canceling setup leaves your account’s active methods unchanged. Under **Account recovery**, you can see how many unused codes remain. Choose **Generate new codes**, verify your identity, and save and confirm the replacement set. Finishing invalidates the old codes and signs out other sessions. ## Sign in or recover access Sign in with your password or Google account, then complete **Verify your sign-in** with a passkey or authenticator code. Choose **Try another way** to switch methods. If you cannot use any enrolled method: 1. Choose **Try another way → Use a recovery code**. 2. Enter an unused recovery code and choose **Verify**. 3. Choose **Set up a new passkey** or **Set up a new authenticator**. 4. Complete setup and save the new recovery codes within five minutes. Recovery signs out all sessions. You can enter the app only after finishing the replacement setup, which removes all previous verification methods and replaces the recovery codes. If recovery expires or you cancel passkey recovery, start sign-in again with another unused code. If you have lost every method and all recovery codes, ask an eligible workspace Owner or Admin in a shared workspace for an account-security reset. They must verify your identity through a trusted channel first. A reset removes MFA across your account and signs you out everywhere. Follow the email instructions to sign in and set up protection again. If no eligible administrator is available, [contact support](https://zentrik.ai/support). Resetting your password preserves MFA; it does not replace a lost verification method. ## Manage methods and sessions Return to **Profile & security** to make changes: - **Replace app** connects a new authenticator after verification. The old app stays active until you finish; your recovery codes stay valid. - **Remove** beside a passkey or **Remove app** removes that method after verification and confirmation. Removing your last method turns MFA off and invalidates recovery codes. - **Active sessions → Sign out other sessions** keeps this browser signed in and requires other browsers to sign in again. Adding, replacing, or removing methods also signs out other sessions. These controls govern browser access. API keys and authorized integrations have separate access and revocation controls; see [Workspace administration](https://zentrik.ai/docs/product/workspace-administration#keys). ## Troubleshooting ### Passkey setup is unavailable or canceled Use a browser and device that support passkeys, or set up an authenticator app. If setup is temporarily unavailable, retry later or contact support. Canceling a device prompt does not activate a new method. During recovery, restart sign-in with another unused recovery code if prompted. ### An authenticator code is rejected Check that your device uses automatic date and time, then wait for a fresh code. A code already used for sign-in or another security action cannot be reused. If the challenge expired, start sign-in again; if a retry delay is shown, wait before trying again. ### I cannot find my saved recovery codes Zentrik cannot show the previous codes again. If you can still verify with an enrolled method, open **Profile & security → Account recovery → Generate new codes**, then save and confirm the new set. If all verification methods are lost too, follow the administrator or support path above. ## Related guides - [Invite people and manage access](https://zentrik.ai/docs/product/workspace-access) - [Set up and manage teams](https://zentrik.ai/docs/product/teams) - [Organize customer Accounts without losing the source context](https://zentrik.ai/docs/product/accounts-and-company-groups)