# Secure your account

> Source: https://elaichi.ai/docs/guides/settings/security/

Protect **your user account** (across every organization you belong to) with an authenticator app and optional passkeys. This tab is personal — it is not an organization-wide MFA policy.

**Where to find it:** **Settings → Security**

No special org permission is required. Every signed-in member can manage their own factors here.

## Two-factor authentication (TOTP)

After social, magic-link, or SSO sign-in, Elaichi asks for a **6-digit code** from an authenticator app (1Password, Google Authenticator, Authy, and similar).

### Enroll

1. Open **Settings → Security**.
2. Under **Two-factor authentication**, choose **Set up two-factor authentication**.
3. Scan the QR code, or copy the secret into your app manually.
4. Enter the current 6-digit code and choose **Verify & enable**.
5. Elaichi shows **8 one-time recovery codes**. Copy or download them somewhere safe — **they are shown only this once**.
6. Choose **I saved my recovery codes**.

**You'll know it worked when:** The status shows active, and the next sign-in prompts for a code — see [Two-factor sign-in](/guides/basics/two-factor-sign-in).

### Recovery codes

- You receive **8** codes at enrollment (format like `xxxx-xxxx`).
- Each code works **once** if you lose the authenticator.
- **Regenerate recovery codes** issues a new set of 8 and invalidates the old ones. Save the replacements immediately. This requires [confirming it’s you](/guides/basics/confirming-sensitive-actions).

### Disable

**Disable two-factor authentication** turns TOTP off after step-up confirmation. Prefer regenerating recovery codes or fixing the authenticator before disabling in production accounts.

## Passkeys

Sign in with Face ID, Touch ID, Windows Hello, or a security key.

| Action | Details |
| --- | --- |
| **Add passkey** | Optional label, then complete the browser/device ceremony |
| **Rename** | Edit the display name later |
| **Delete** | Removes that passkey after step-up confirmation |

Passkeys show as **Synced** or **Device-bound** depending on the credential.

:::callout{type="warning"}
If you have only one passkey and TOTP is not enabled, enable two-factor authentication before deleting that final passkey. Removing the last passkey requires TOTP confirmation.
:::

Adding or removing passkeys uses the same [Confirm it’s you](/guides/basics/confirming-sensitive-actions) flow as other sensitive account changes.

## Sensitive actions

Disabling MFA, regenerating recovery codes, managing passkeys, and revoking API tokens all require a fresh proof of identity. Details: [Confirming sensitive actions](/guides/basics/confirming-sensitive-actions).

## Good to know

- MFA applies to your account globally, not per organization.
- Five failed MFA attempts during sign-in end the pending session — start sign-in again.
- Store recovery codes offline; they are as powerful as the authenticator for account unlock.

## Related

- [Confirming sensitive actions](/guides/basics/confirming-sensitive-actions)
- [Two-factor sign-in](/guides/basics/two-factor-sign-in)
- [Sign in](/guides/basics/sign-in)
- [Create API tokens](/guides/settings/api-tokens)