Account & preferences
Two-factor authentication
Add a TOTP code on top of your password, with one-time recovery codes for lost devices.
Two-factor authentication (2FA) is opt-in, per account, and uses time-based one-time codes (TOTP) — any authenticator app works: Aegis, Google Authenticator, 1Password, and the rest.
Turning it on
Preferences → Security → Enable two-factor authentication:
- Scan the QR code
Or enter the key manually if your app doesn’t support scanning.
- Confirm with a 6-digit code
Proves the app is set up correctly before 2FA actually turns on.
- Save your recovery codes
Ten single-use codes, shown exactly once — copy them or download the
.txt. Lose both the device and these, and you’re locked out; see Troubleshooting.
Recovery codes are shown once, at setup, and never again. Store them somewhere durable — a password manager, a printout — before closing the dialog.
Signing in
After a fresh login (email + password), you’re asked for a 6-digit code from your authenticator app. Use a recovery code instead sits on the same screen for a lost or wiped device — each recovery code works once.
Sessions stay signed in for about 30 days, so you’re not asked for a code on every visit — only on new logins.
Managing it
Once enabled, Preferences → Security shows how long it’s been on and how many recovery codes you have left:
- Regenerate recovery codes — issues a fresh set of ten and invalidates the old ones. Needs your current password.
- Disable — turns 2FA off entirely. Also needs your current password.
Too many wrong codes
Repeated wrong codes trigger a temporary lockout — wait a few minutes and try again. This applies to both the 6-digit code and recovery codes.
Bots and API keys
Personal access tokens never go through the interactive login screen, so 2FA has no effect on bots or scripts using the REST API.