Two-factor authentication (2FA)

2FA adds an additional layer of security during login — in addition to the password, a time-based code (TOTP) is required.

Set up 2FA

1. Profile → 2FA → "Set up"
2. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password)
3. Enter the 6-digit code for verification
4. 2FA is activated

Login with 2FA

1. Enter email + password
2. Enter the 6-digit code from the authenticator app
3. Optionally: "Trust this device" — skips 2FA on this device for 30 days

Trusted Devices

Trusted devices can be viewed and removed under Profile → 2FA → Devices.

Disable 2FA

Profile → 2FA → "Disable" — Requires the current 2FA code. Cannot be disabled during active impersonation.

2FA Reset (Admin)

If a user has lost access to their authenticator app, an admin can reset the 2FA: Administration → Users → "Reset 2FA"