Account security

1. On your account page, select Enable two-factor.
2. Scan the QR code with an authenticator app and enter the 6-digit code.
3. Save the 10 recovery codes somewhere safe. Each works once if you lose your authenticator, and they're only shown once.

Owners can require two-factor for everyone under Settings → Security policies. Members without it are asked to set it up before they can open the organization.

Sign in with email and password, Google, or GitHub. Forgot your password? Use Forgot your password? on the sign-in page; the link is valid for one hour.

Your account page lists every signed-in device with its system, browser, location, and IP address. Revoke anything you don't recognize; it's signed out immediately. Resetting your password signs out every session.