Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app when you sign in on a new device. A stolen password alone is then not enough.
Turn on 2FA
- Open the menu with your name at the bottom of the sidebar and choose Account.
- Under Two-factor authentication, choose Set up.
- Confirm with your password and choose Continue.
- Scan the QR code with 1Password, Google Authenticator, Authy or a similar app. If you can’t scan, type in the key shown next to it.
- Save the backup codes, for example in a password manager. Each code signs you in once if you lose your phone.
- Enter the 6-digit code from the app and choose Turn on.
In the same section you can later create New backup codes or Turn off 2FA.
Require 2FA for the whole workspace
An owner or admin can turn on Require two-factor authentication under Settings, General, Security. Members who sign in with a password then set up an authenticator app before they can open the workspace. The same card shows how many members haven’t set it up yet.
Good to know
- The code is asked for after the password. If you signed up with Google, GitHub or an email link, set a password first and the section appears.
- With 2FA on, you sign in with your password and a code. Sign-in links by email are no longer sent.
- Google and GitHub sign-in count as two-factor, since both have their own.
- API keys are not affected by the workspace requirement.
- Lost both your phone and your backup codes? Contact support from the email address on your account.