Skip to main content
Two-factor authentication (2FA) asks for something you have after your password, so a stolen password alone can’t open your account. It is free on every plan. You can use an authenticator app, a passkey, or both. Everything lives in Settings → Security.

Authenticator app

1

Start the set-up

Under Two-factor authentication, click Set up authenticator app.
2

Scan the QR code

Scan it with an authenticator app such as 1Password, Google Authenticator or Authy. If you can’t scan, type the Key for manual entry into the app.
3

Confirm a code

Enter the 6-digit code the app shows and click Turn on.
4

Save your recovery codes

You get ten recovery codes, shown once. Copy or download them and keep them somewhere safe.
From then on, signing in with your password (or with Google) asks for a code on a second screen. A code from the previous or next 30 seconds is accepted, to allow for a slightly wrong clock, and each code works only once.

Passkeys

A passkey signs you in with your fingerprint, face or device PIN instead of a password and code.
  • Add a passkey: under Passkeys, give it a name (for example “MacBook”) and click Add a passkey, then follow your browser’s prompt. Synced passkeys (iCloud Keychain, Google Password Manager, 1Password) work on all your devices.
  • Sign in with a passkey: on the sign-in page, click Sign in with a passkey. It counts as both factors, so there is no code step.
  • As a second factor: on the code screen after your password, click Use a passkey.
  • Rename or remove a passkey from its row. You can have up to 10.
If a passkey is your first second factor, you also get ten recovery codes.

Recovery codes

If you lose your phone or passkey, choose Use a recovery code on the code screen. Each code works once. The Security page shows how many you have left; New recovery codes replaces the whole set (the old ones stop working).
Without your authenticator app, a passkey or a recovery code, you can’t finish signing in. A password reset does not turn off two-factor authentication. Contact support if you are locked out.

If you are locked out

Contact support. Once support has confirmed who you are, they can reset two-factor on your account: your authenticator app, every passkey and your recovery codes are removed, and you get an email saying so. You can then sign in without a second factor. Set it up again straight away under Settings → Security; if one of your workspaces requires two-factor authentication, you will be asked to before you can do anything else. The reset is listed under Recent security activity.

Confirm it’s you

Turning off the authenticator app, removing a passkey, generating new recovery codes and adding a passkey to an account that already has two-factor authentication all ask you to confirm it’s you with a code, a recovery code or a passkey. The confirmation lasts 5 minutes. Each of these changes is listed under Recent security activity and emailed to you. If you get one of those emails and it wasn’t you, change your password right away.

Require two-factor authentication for a workspace

Owners and administrators can turn on Require two-factor authentication under Settings → Security. You need two-factor authentication on your own account first. When it’s on, any member without an authenticator app or passkey sees only a set-up screen (and Sign out) until they add one. The card shows how many members still need to set it up. Invitations to the workspace mention the requirement. The requirement also applies to people who reach the workspace through its organization (an agency’s team members), not only to the workspace’s own members.
Support staff (see Account and security) can’t change two-factor settings during a support session, and InstantCampaign platform admins must use two-factor authentication themselves before they can open the back office or start a support session.