Security & recovery

Set up authenticator protection, save recovery codes and manage active sessions.

Reviewed 16 October 2026. Available controls depend on your role, plan and service configuration.

Set up an authenticator app

Open Workspace → Security → Authenticator app. Confirm your current password and choose Set up authenticator. Scan the QR code in a compatible app, or manually enter the setup key using a time-based account. Within the ten-minute setup window, confirm your password and the app’s six-digit code, then Enable authenticator. All devices are signed out. Save the recovery codes shown next before logging in again.

Recovery codes and a replacement phone

Recovery codes are shown once and each works once. Download or store them privately outside the device containing your authenticator. Replace recovery codes requires your password and an authenticator or unused recovery code; old codes stop working and all devices are signed out. To replace the authenticator, confirm and disable the old one, sign in again, then set up the new app. Complete the new setup promptly.

Disable authenticator protection

Disable authenticator requires your current password and an authenticator or recovery code. It removes that protection and signs out all devices. Previously enabled email two-step verification remains enabled. If both your authenticator and recovery codes are unavailable, contact support; a password reset alone does not disable 2FA.

Email two-step sign-in

When an authenticator is not enabled, Security offers email Two-step sign-in. Choose Enable or Disable, then confirm with the six-digit code sent to your sign-in email. Codes expire after ten minutes and changes sign out existing sessions. Authenticator protection takes precedence; email codes do not bypass it. Keep access to your sign-in inbox.

Backup email and phone

Add a different backup email, request its code and confirm it to save the verified address. It does not replace the sign-in email or automatically enable an alternative login route. Choose a country calling code and save your contact phone, or clear it. The phone number is for contact only: SMS verification and SMS OTP are not enabled.

Devices and sessions

Under Devices & sessions, inspect the device label and last-active time. Labels come from browser information and may not identify a physical device precisely. Sign out a specific session or choose Log out everywhere to revoke all sessions, including the current one. After suspicious activity, sign out other sessions, reset your password and review team/public access.

Code and setup problems

Use the newest code, check your device clock uses automatic time and wait for a fresh authenticator code if needed. Reused recovery codes fail. Repeated attempts trigger temporary limits. If setup is unavailable, the server’s security configuration may need completion; contact support. Never send passwords, QR setup keys, recovery codes or one-time codes in a support request.