Skip to content

Secure your account

Protect your user account (across every organization you belong to) with an authenticator app and optional passkeys. This tab is personal — it is not an organization-wide MFA policy.

Where to find it: Settings → Security

No special org permission is required. Every signed-in member can manage their own factors here.

Two-factor authentication (TOTP)

After social, magic-link, or SSO sign-in, Elaichi asks for a 6-digit code from an authenticator app (1Password, Google Authenticator, Authy, and similar).

Enroll

  1. Open Settings → Security.
  2. Under Two-factor authentication, choose Set up two-factor authentication.
  3. Scan the QR code, or copy the secret into your app manually.
  4. Enter the current 6-digit code and choose Verify & enable.
  5. Elaichi shows 8 one-time recovery codes. Copy or download them somewhere safe — they are shown only this once.
  6. Choose I saved my recovery codes.

You'll know it worked when: The status shows active, and the next sign-in prompts for a code — see Two-factor sign-in.

Recovery codes

  • You receive 8 codes at enrollment (format like xxxx-xxxx).
  • Each code works once if you lose the authenticator.
  • Regenerate recovery codes issues a new set of 8 and invalidates the old ones. Save the replacements immediately. This requires confirming it’s you.

Disable

Disable two-factor authentication turns TOTP off after step-up confirmation. Prefer regenerating recovery codes or fixing the authenticator before disabling in production accounts.

Passkeys

Sign in with Face ID, Touch ID, Windows Hello, or a security key.

Action Details
Add passkey Optional label, then complete the browser/device ceremony
Rename Edit the display name later
Delete Removes that passkey after step-up confirmation

Passkeys show as Synced or Device-bound depending on the credential.

Warning

If you have only one passkey and TOTP is not enabled, enable two-factor authentication before deleting that final passkey. Removing the last passkey requires TOTP confirmation.

Adding or removing passkeys uses the same Confirm it’s you flow as other sensitive account changes.

Sensitive actions

Disabling MFA, regenerating recovery codes, managing passkeys, and revoking API tokens all require a fresh proof of identity. Details: Confirming sensitive actions.

Good to know

  • MFA applies to your account globally, not per organization.
  • Five failed MFA attempts during sign-in end the pending session — start sign-in again.
  • Store recovery codes offline; they are as powerful as the authenticator for account unlock.