> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bizzyco.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-factor authentication

> Protect your account with TOTP codes and recovery backup codes

Two-factor authentication (2FA) requires a one-time code from an authenticator
app each time you sign in. Bizzy uses TOTP (time-based one-time passwords), the
same standard used by Google Authenticator, 1Password, Authy, and most other
authenticator apps.

## Prerequisites

* A signed-in Bizzy account with email-and-password sign-in (your password is
  required to enable 2FA)
* An authenticator app installed on your phone or password manager

## Enable two-factor authentication

1. Navigate to **Settings > User > Security**
2. In the **Two-factor authentication** card, click **Enable two-factor
   authentication**
3. Enter your current password to confirm
4. Scan the displayed QR code with your authenticator app — or enter the secret
   manually if you can't scan
5. Enter the 6-digit code your app generates to verify the setup
6. Save the **backup codes** displayed on the next screen, then click **Done**

<Warning>
  Backup codes are shown **only once**. Save them in a password manager or
  other secure location before clicking Done. You'll need them if you ever
  lose access to your authenticator app.
</Warning>

### Backup codes

Each backup code can be used once in place of a TOTP code. Use them when you
don't have your authenticator app handy — for example, after losing or wiping a
phone.

To generate a fresh set:

1. In the **Two-factor authentication** card, click **Regenerate backup codes**
2. Enter your current password
3. Save the new codes — the previous set is invalidated immediately

## Sign in with two-factor authentication

When 2FA is enabled, sign-in requires two steps:

1. Enter your email and password
2. Enter the 6-digit code from your authenticator app (or a one-time backup
   code)

You're prompted on every new session — existing sessions stay valid until they
expire normally.

## Disable two-factor authentication

1. Navigate to **Settings > User > Security**
2. In the **Two-factor authentication** card, click **Disable 2FA**
3. Enter your current password to confirm

Disabling clears your TOTP secret and all unused backup codes.

## Limitations

* **Self-serve only.** 2FA is per-user; Bizzy does not yet support
  organization-wide 2FA enforcement
* **Active sessions list not yet available.** You can't currently view or revoke
  individual signed-in sessions from the security settings page — clearing
  browser cookies or changing your password ends all sessions

## Recovering a locked-out account

If you've lost access to both your authenticator app and your backup codes,
contact support — there is no self-serve path to disable 2FA without one of
those factors.

## Next steps

<CardGroup cols={2}>
  <Card title="Passkeys" icon="fingerprint" href="/admin-guide/security/passkeys">
    Sign in with biometrics or a hardware key
  </Card>

  <Card title="API keys" icon="key" href="/admin-guide/security/api-keys">
    Programmatic access for integrations
  </Card>
</CardGroup>