> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instantcampaign.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-factor authentication and passkeys

> Protect your sign-in with an authenticator app or a passkey, keep recovery codes, and require two-factor authentication for everyone in a workspace.

Two-factor authentication (2FA) asks for something you have after your password, so a stolen password alone can't open your account. It is free on every plan. You can use an **authenticator app**, a **passkey**, or both.

Everything lives in **Settings → Security**.

## Authenticator app

**1. Start the set-up**

Under **Two-factor authentication**, click **Set up authenticator app**.

**2. Scan the QR code**

Scan it with an authenticator app such as 1Password, Google Authenticator or Authy. If you can't scan, type the **Key for manual entry** into the app.

**3. Confirm a code**

Enter the 6-digit code the app shows and click **Turn on**.

**4. Save your recovery codes**

You get ten recovery codes, shown once. Copy or download them and keep them somewhere safe.

From then on, signing in with your password (or with Google) asks for a code on a second screen. A code from the previous or next 30 seconds is accepted, to allow for a slightly wrong clock, and each code works only once.

## Passkeys

A passkey signs you in with your fingerprint, face or device PIN instead of a password and code.

* **Add a passkey**: under **Passkeys**, give it a name (for example "MacBook") and click **Add a passkey**, then follow your browser's prompt. Synced passkeys (iCloud Keychain, Google Password Manager, 1Password) work on all your devices.
* **Sign in with a passkey**: on the sign-in page, click **Sign in with a passkey**. It counts as both factors, so there is no code step.
* **As a second factor**: on the code screen after your password, click **Use a passkey**.
* **Rename or remove** a passkey from its row. You can have up to 10.

If a passkey is your first second factor, you also get ten recovery codes.

## Recovery codes

If you lose your phone or passkey, choose **Use a recovery code** on the code screen. Each code works once. The Security page shows how many you have left; **New recovery codes** replaces the whole set (the old ones stop working).

> [!WARNING]
>
> Without your authenticator app, a passkey or a recovery code, you can't finish signing in. A password reset does not turn off two-factor authentication. Contact support if you are locked out.

### If you are locked out

Contact support. Once support has confirmed who you are, they can **reset two-factor** on your account: your authenticator app, every passkey and your recovery codes are removed, and you get an email saying so. You can then sign in without a second factor. Set it up again straight away under **Settings → Security**; if one of your workspaces requires two-factor authentication, you will be asked to before you can do anything else. The reset is listed under **Recent security activity**.

## Confirm it's you

Turning off the authenticator app, removing a passkey, generating new recovery codes and adding a passkey to an account that already has two-factor authentication all ask you to **confirm it's you** with a code, a recovery code or a passkey. The confirmation lasts 5 minutes.

Each of these changes is listed under **Recent security activity** and emailed to you. If you get one of those emails and it wasn't you, change your password right away.

## Require two-factor authentication for a workspace

Owners and administrators can turn on **Require two-factor authentication** under **Settings → Security**. You need two-factor authentication on your own account first.

When it's on, any member without an authenticator app or passkey sees only a set-up screen (and **Sign out**) until they add one. The card shows how many members still need to set it up. Invitations to the workspace mention the requirement.

The requirement also applies to people who reach the workspace through its [organization](https://docs.instantcampaign.ai/guides/sending-and-workspace/organizations.md) (an agency's team members), not only to the workspace's own members.

> [!NOTE]
>
> Support staff (see [Account and security](https://docs.instantcampaign.ai/guides/sending-and-workspace/account-and-security.md#support-access)) can't change two-factor settings during a support session, and InstantCampaign platform admins must use two-factor authentication themselves before they can open the back office or start a support session.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.