Sessions, passwords and 2FA

My account is where you manage your own credentials — password, email, two-factor authentication, passkeys — and sign yourself out everywhere at once.

What it is

Beyond the ordinary profile and password fields, two second-factor options are offered: TOTP (an authenticator app) and passkeys (device biometrics or a hardware key) — either satisfies a second-factor requirement. Manager, org-admin and owner roles have two-factor authentication enforced, not just encouraged; every other role sees a nudge but is never blocked. Sign out everywhere revokes every active session on every device immediately, including this one at its next token refresh.

Before you start

Enrolling a second factor needs a verified email address — if verification failed to send or landed in spam, this page also offers to resend it.

How to do it

1. Open Settings → My account.
2. To enrol TOTP, click Set up 2FA, scan the QR code with your authenticator app, and enter the six-digit code it shows to confirm.
3. To add a passkey instead, click Add a passkey and follow your device’s own biometric or hardware-key prompt.
4. To force a fresh sign-in everywhere, click Sign out everywhere — you’ll need to sign back in on this device too.
5. If a colleague is locked out, an administrator can reset their password or revoke their sessions from Members & seats instead of this page.

How it integrates

A role that requires two-factor authentication is checked at sign-in and again for the platform’s own most sensitive actions — the requirement travels with the role, not with whichever factor you happened to enrol first. Removing your only remaining second factor is refused server-side when your role requires one, so you can’t accidentally lock yourself out of a mandatory requirement — replace it with another factor first, rather than removing the last one outright. An administrator revoking someone else’s sessions, or resetting their password, is a separate, narrower-gated action recorded in the audit log; see Members and seats.

Common problems

• I can’t remove my only 2FA factor. That’s deliberate for a role that requires one — enrol a replacement first, then remove the old one.
• My 2FA code is rejected even though I know it’s a live enrolled factor. Sign out and back in — a stale session can carry an out-of-date second-factor claim even though the server-side enrolment itself is fine; this is a session problem, not a reason to remove and re-enrol.
• “Sign out everywhere” didn’t seem to affect my current tab. It revokes tokens on their next refresh, not mid-session instantly — you’ll be prompted to sign in again shortly, or on your next action that needs a fresh token.