Secure your account

Two-factor authentication adds a second step to sign-in, such as a code from an authenticator app or a passkey. This page covers your personal security settings, which apply to your account in every organization you belong to. An organization owner or admin can also require every member to use a second factor. See When your organization requires two-factor authentication and Require two-factor authentication for your organization.

Where to find it: Settings → Security

Before you start

You need no special permission. Every signed-in member manages their own two-factor settings on this tab. To require two-factor authentication for a whole organization, you need Manage organization (org:manage).

Set up two-factor authentication with an authenticator app

After you sign in with Google, GitHub, Microsoft, an email code, or SSO, Elaichi asks for a 6-digit code from your authenticator app. Apps such as 1Password, Google Authenticator, and Authy work.

1. Open Settings → Security.
2. Under Two-factor authentication, click Set up two-factor authentication.
3. Scan the QR code, or copy the secret into your app.
4. Enter the current 6-digit code and click Verify & enable.
5. Elaichi shows 8 one-time recovery codes. Copy or download them and keep them somewhere safe.
6. Click I saved my recovery codes.

You will see the status change to active. Your next sign-in asks for a code. See Two-factor sign-in.

If you have no other second factor, setting up an authenticator app needs a recent sign-in. If Elaichi asks you to sign in again, do that. You return to the setup page.

Replace your recovery codes

1. Open Settings → Security.
2. Click Regenerate recovery codes.
3. Confirm it’s you.
4. Save the new set of 8 codes.

The new codes replace the old ones. The old codes stop working at once.

Turn off two-factor authentication

1. Open Settings → Security.
2. Click Disable two-factor authentication.
3. Confirm it’s you.

If an organization you belong to requires two-factor authentication and you have no passkey, you cannot turn it off. The page tells you why. Add a passkey first.

Add, rename, or delete a passkey

A passkey lets you sign in with Face ID, Touch ID, Windows Hello, or a security key.

Each passkey shows Synced or Device-bound, depending on how your device stores it.

Adding and deleting passkeys use the same confirmation step as other sensitive account changes.

How long you stay signed in

Every browser session has two limits. They are the same for everyone, and an organization cannot change them.

When a session ends, Elaichi shows the sign-in screen with a short note about why. After you sign in, it takes you back to the page you were on. If you stay away for more than about a week and a day, the note is not shown, and you see only the sign-in screen.

These limits work as an automatic log-off, for example for HIPAA. They apply to signed-in browser sessions. API tokens and connected apps have their own lifecycles and are not signed out by these limits.

When your organization requires two-factor authentication

An organization owner or admin can require every member to use a second factor. If your organization does, and your current session has not shown one, Elaichi stops you before you reach the organization and opens Set up two-factor authentication. Choose an authenticator app or a passkey. With an authenticator app, you also save your recovery codes. When you finish, Elaichi takes you back to the page you were opening. You do not need to sign in again.

• You already have a second factor, but this session did not use it. For example, you signed in with Google before you set it up. Elaichi asks you to sign in again, and the next sign-in asks for your code or passkey.
• What counts as a second factor. Signing in with a passkey. Signing in and entering your authenticator code. Setting up a factor during the current session. Signing in through that organization’s own SSO connection, because your identity provider has already applied its own policy.
• SSO covers one organization only. An SSO sign-in counts for the organization that owns the SSO connection. It does not satisfy another organization’s requirement.
• Not affected. API tokens, and Elaichi support sessions, which are time-limited and which you can turn off in Settings → Organization.
• AI clients. When you connect an MCP client such as Claude, ChatGPT, Cursor, or Microsoft Copilot, Elaichi checks for a second factor on the consent screen. A connection that was made without one stops working. Set up a second factor in Elaichi, then connect the client again.
• You cannot remove your last second factor while an organization you belong to requires one. Turning off the authenticator app needs a passkey. Deleting your last passkey needs the authenticator app.

Require two-factor authentication for your organization

Where to find it: Settings → Organization → Security → Require two-factor authentication (needs the Manage organization permission).

1. Open Settings → Organization.
2. In the Security group, switch Require two-factor authentication on.
3. Read the count under the switch. It shows how many members have no second factor yet.

Members without a second factor are asked to set one up the next time they open the organization. Nobody is signed out when you switch it on. The setting is off by default, including for new organizations.

• You cannot lock yourself out. If your own session has not shown a second factor, the switch is greyed out and says why. Set up two-factor authentication on your own account, or sign in again with it, and the switch becomes available. If you try anyway, the API answers 409 mfa_setup_required.
• Turning it off needs you to confirm it’s you.
• Only a person at a browser can change it. An API token, an AI client, or an Elaichi support session cannot change this setting.
• It is recorded. The audit log’s Organization updated entry shows the old and the new value.
• It applies to one organization. A member of several organizations is asked only when they open one that requires it.

What to know

• Your second factor belongs to your account everywhere. Whether it is required is a setting of each organization.
• Five failed two-factor attempts during sign-in end the pending sign-in. Start again.
• Store recovery codes offline. They unlock your account as well as your authenticator does.
• Elaichi asks you to confirm it’s you before sensitive account changes. See Confirming sensitive actions for the current list.

Related

• Confirming sensitive actions
• Two-factor sign-in
• Sign in
• Create API tokens