# Confirming sensitive actions

> Source: https://elaichi.ai/docs/guides/basics/confirming-sensitive-actions/

Prove it’s still you before Elaichi lets through changes that could lock you out or revoke access. Being signed in isn’t enough for those actions — a **Confirm it’s you** dialog asks again.

This protects the account itself. If someone walks up to an unlocked laptop, they still can’t disable your two-factor authentication or quietly revoke a token.

**Where to find it:** Appears automatically when you start a sensitive change (for example under **Settings → Security** or **Settings → API tokens**).

## Actions that require step-up

Elaichi requires a fresh confirmation for exactly these actions:

| Action | When you see it |
| --- | --- |
| **Revoke an API token** | **Settings → API tokens** → Revoke |
| **Disable two-factor authentication** | **Settings → Security** → Disable two-factor authentication |
| **Regenerate recovery codes** | **Settings → Security** → Regenerate recovery codes |
| **Add a passkey** | **Settings → Security** → Add passkey |
| **Delete a passkey** | **Settings → Security** → delete on a passkey |
| **Delete your final passkey** | Same delete flow when it would remove your last passkey — confirmation must use **TOTP** (enable two-factor authentication first if you don’t have it) |

No other Settings actions use this prompt today.

## Confirm with a second factor

The dialog uses whichever second factor you have:

- **With a passkey** — your browser or device prompts you (except when deleting the **final** passkey, which requires TOTP). If the prompt doesn’t appear, or you dismiss it, choose **Try passkey again**.
- **With an authenticator app** — enter the current six-digit code, or one of your recovery codes (when TOTP verification allows either).

Once confirmed, the change goes through immediately. Cancelling leaves everything exactly as it was. A successful confirmation is short-lived and covers **that one action** only.

## Good to know

- Doing two sensitive things means confirming twice.
- If you haven’t set up a second factor yet, Elaichi asks you to enroll first — see [Secure your account](/guides/settings/security).
- A wrong or expired code fails; try again with a fresh one.
- Recovery codes used here are single-use, same as at sign-in.
- This flow only works in a normal browser session — not via API tokens.

## Related

- [Secure your account](/guides/settings/security)
- [Two-factor sign-in](/guides/basics/two-factor-sign-in)
- [Create API tokens](/guides/settings/api-tokens)