Two-step sign-in (MFA)

With two-step sign-in, signing in takes your password and a 6-digit code from an app on your phone. Someone who learns your password still can't get in. It's optional, and it takes about a minute to set up.

Any authenticator app works: Google Authenticator, Microsoft Authenticator, Authy or 1Password. You can connect one app per login.

Turn it on

1. Open Settings → Security and press Set up MFA.
2. In your app, tap + (Add account) and scan the QR code. If you can't scan it, press Can't scan it? and type the key in instead.
3. Type the 6-digit code your app shows.
4. Save your 10 recovery codes: copy them or download the .txt file, and keep them somewhere other than your phone, such as a password manager.

From then on, after your password you'll be asked for the current code. Codes change every 30 seconds; type the newest one.

Recovery codes

Each recovery code lets you sign in once without your phone. Choose Use a recovery code on the sign-in screen. Settings → Security shows how many you have left; press New recovery codes to replace them all (the old ones stop working).

New phone

Turn MFA off in Settings → Security (you need your password and a code from the old phone, or a recovery code), then set it up again on the new phone. Apps that back up to the cloud, like Google Authenticator's sync, 1Password or Authy, move to a new phone by themselves.

Lost your phone

• You have your recovery codes: sign in with one, then turn MFA off and set it up again.

• You're a team member: ask your team's Owner or Admin. In Settings → Team they choose Reset MFA (lost phone) on your login. You're signed out, sign in with just your password, and set MFA up again.

• No phone and no recovery codes: email support from your account's email address. We send you a confirmation link. 24 hours after you confirm, MFA is removed and you can sign in with your password.

  For your safety, that support reset also clears every saved key and connection in the workspaces you own: server SSH keys and passwords, cloud credentials, Jenkins, Grafana, MCP and database connections, Git tokens, app environment values and alert channels. Your servers, projects, chats and files stay. Afterwards you reconnect each server with its key (PEM). Managed database passwords and backups unlock once their server is reconnected.

  This is what makes a reset useless to someone pretending to be you: they would get an account that can't reach any of your servers. Every step is emailed to you with a link to cancel, and signing in with your authenticator cancels it too.

Self-hosted

Team members are reset by the Owner as above. There's no support reset for the Owner's own login; keep the recovery codes safe. Whoever runs the install can clear it on the server; see the self-hosting guide.