Turning on two-factor authentication

Two-factor authentication adds a code from an authenticator app to your password at sign-in, so a stolen password alone can't get into your account.

Turn it on. Go to Settings → Security and find Two-factor authentication. Choose Turn on, confirm your password, then scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy, or similar) — or type the key shown underneath by hand if you can't scan. Enter the 6-digit code your app shows to confirm.

You'll be given 10 backup codes the moment it's confirmed. Save them somewhere safe — each works once, in place of an authenticator code, and this is the only time they're shown. Copy or download them before you close the screen.

Signing in afterward. Enter your password as usual, then your authenticator code. Check "Remember this device for 30 days" on a device you trust to skip the code on that device until it expires. Lost your device? Use a backup code instead.

Running low on backup codes, or lost them? Regenerate from the same Two-factor authentication panel — your password is required, and this replaces every old code at once.

Turning it off also asks for your password, since removing it is a security-relevant change.

For an owner: requiring it for everyone. Settings → Team & Roles has a "Require two-factor for all members" switch. Turn on your own two-factor first — an owner can't require something for the team they haven't done themselves. Once it's on, anyone without two-factor is asked to set it up the next time they sign in, before they can do anything else. An owner can also reset a member's two-factor from that same page if they've lost their device; the member is emailed and asked to set it up again.